ShieldBreak Zero-Day Lets Local Users Escalate to SYSTEM via Microsoft Defender

A publicly disclosed zero-day dubbed ShieldBreak (CVE-2026-69414) affects the Microsoft Malware Protection Engine used by Microsoft Defender and allows an authenticated local attacker to escalate from a standard user account to NT AUTHORITY\SYSTEM. Researchers reported that the flaw bypasses Microsoft's earlier July fix for RoguePlanet (CVE-2026-50656), and a working proof-of-concept has been released. Microsoft acknowledged the issue and said it is developing a fix, but no patch was available at publication.

Reports say the vulnerability impacts modern Windows environments where Microsoft Defender is enabled, including Windows 11 25H2 and Windows Server 2025, with one source also listing Windows 10 as affected while another said Windows 10 exposure remained unconfirmed. The issue is not remote and requires prior code execution or authenticated local access, but defenders were urged to treat it as high risk because public exploit code lowers the barrier to abuse. Recommended interim actions include restricting local access, monitoring for privilege-escalation behavior and suspicious processes, validating EDR/EPP coverage, enabling protections such as Tamper Protection and Attack Surface Reduction where appropriate, and applying Microsoft's patch as soon as it becomes available.