Loading story…
A publicly disclosed zero-day dubbed ShieldBreak (CVE-2026-69414) allows a local attacker with limited privileges to escalate to SYSTEM on Windows systems where Microsoft Defender is enabled. Reporting says the flaw affects the Microsoft Malware Protection Engine and serves as a bypass of Microsoft’s earlier fix for RoguePlanet (CVE-2026-50656), indicating the prior remediation was incomplete. Microsoft has acknowledged the issue and said it is working on a patch, but no release date has been announced.
Technical analysis shows the exploit chains Cloud Files abuse, NT Object Manager namespace manipulation, direct use of Defender functionality through MpClient.dll, a remediation timing race, and Windows Error Reporting task abuse to coerce Defender into writing an attacker-controlled DLL to C:\Windows\System32\phoneinfo.dll, which is then executed by wermgr.exe as SYSTEM. Researchers reproduced the proof of concept on fully patched Windows 11 24H2 and Windows Server 2025 systems with default Defender settings, with elevation reportedly occurring in roughly eight to twelve seconds; key detection opportunities include creation of phoneinfo.dll in System32, MpClient.dll loading by non-Defender processes, suspicious activity under \BaseNamedObjects\Restricted\, and wermgr.exe loading the planted DLL.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft confirmed on August 17, 2026 that it was working on a patch for ShieldBreak, tracked as CVE-2026-69414. No patch release date was announced at that time.
After Microsoft's August 2026 Patch Tuesday, disclosure actor Nightmare-Eclipse publicly released the ShieldBreak proof of concept, a local privilege escalation chain abusing Microsoft Defender remediation to gain SYSTEM privileges. Reporting says the disclosure was made without prior notification to Microsoft.
Microsoft patched RoguePlanet (CVE-2026-50656) in July 2026. Subsequent reporting said ShieldBreak showed the earlier fix was incomplete.
RoguePlanet, a Microsoft Defender privilege escalation vulnerability tracked as CVE-2026-50656, was disclosed in June 2026. Later reporting described ShieldBreak as a bypass of the patch for this earlier flaw.
LevelBlue OpsCTI and THOR reviewed and reproduced the full ShieldBreak exploitation chain on fully patched Windows 11 24H2 and Windows Server 2025 systems with default Windows Defender settings. They reported the exploit could elevate a standard user to SYSTEM in roughly eight to twelve seconds.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcelevelblue.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A publicly disclosed zero-day dubbed **ShieldBreak** (`CVE-2026-69414`) affects the Microsoft Malware Protection Engine used by Microsoft Defender and allows an authenticated local attacker to escalate from a standard user account to **`NT AUTHORITY\SYSTEM`**. Researchers reported that the flaw bypasses Microsoft's earlier July fix for **RoguePlanet** (`CVE-2026-50656`), and a working proof-of-concept has been released. Microsoft acknowledged the issue and said it is developing a fix, but no patch was available at publication. Reports say the vulnerability impacts modern Windows environments where Microsoft Defender is enabled, including **Windows 11 25H2** and **Windows Server 2025**, with one source also listing **Windows 10** as affected while another said Windows 10 exposure remained unconfirmed. The issue is not remote and requires prior code execution or authenticated local access, but defenders were urged to treat it as high risk because public exploit code lowers the barrier to abuse. Recommended interim actions include restricting local access, monitoring for privilege-escalation behavior and suspicious processes, validating EDR/EPP coverage, enabling protections such as Tamper Protection and Attack Surface Reduction where appropriate, and applying Microsoft's patch as soon as it becomes available.
Aug 25, 2026
NightmareEclipse released **ShieldBreak**, a proof-of-concept local privilege-escalation exploit claimed to bypass Microsoft’s fix for **CVE-2026-50656** (RoguePlanet). The exploit allegedly abuses improper link resolution during Windows Defender remediation, combining Cloud Files placeholders, Object Manager symbolic-link swaps, CLFS path handling, an EICAR-triggered scan, and NTFS alternate data streams to redirect a Defender process running as `SYSTEM` and plant `C:\Windows\System32\phoneinfo.dll`. A fabricated Windows Error Reporting report and the `QueueReporting` scheduled task then cause `wermgr.exe` to load the malicious DLL; the included `Warden.dll` payload reportedly duplicates a SYSTEM token and opens a SYSTEM shell in the unprivileged user’s session. Splunk published attack data and multiple disabled-by-default analytics for the ShieldBreak chain, covering Defender activity on `\globalroot\` object-manager paths (Defender Operational events 1116/1117), `MpClient.dll` loaded by non-Defender processes, ADS creation through loopback administrative SMB shares (Security event 5145), manually created `.wer` files in the Windows Error Reporting ReportQueue, creation of phantom DLLs such as `phoneinfo.dll` in system paths, and `WerMgr.exe` spawning SYSTEM-integrity children. Organizations should collect the required Sysmon, Security, and Defender Operational telemetry; enable file-share object-access auditing; investigate these signals promptly; and validate the creating process, signer, file hash, and operational need before suppressing alerts.
Aug 28, 2026
Security researcher **Chaotic Eclipse** has released a proof-of-concept exploit dubbed **ShieldBreak** that allegedly bypasses Microsoft’s fix for `CVE-2026-50656`, also known as **RoguePlanet**, in **Microsoft Defender for Windows**. The flaw affects the **Microsoft Malware Protection Engine** and has been described as a local privilege escalation race condition that can let an attacker with local access spawn a **SYSTEM-level shell** and execute arbitrary code. The researcher said the bypass works reliably on **Windows 11 25H2** and **Windows Server 2025**, and that **Windows 10** is also believed to be vulnerable. Microsoft had issued updates for the RoguePlanet zero-day after acknowledging it earlier, but the new claims suggest the patch was incomplete. The disclosure adds to ongoing scrutiny of Microsoft’s recent security fixes and follows earlier public zero-day releases by the same researcher, including **LegacyHive**, amid a broader dispute over coordinated vulnerability disclosure. Separate reporting also noted that Microsoft recently patched hundreds of flaws and that **CISA** added `CVE-2026-68820`, an actively exploited WinSock driver issue, to its **Known Exploited Vulnerabilities** catalog with a remediation deadline for U.S. federal agencies.
Aug 17, 2026