Loading story…
A researcher using the names Nightmare Eclipse and Chaotic Eclipse released ShieldCrash, a proof of concept said to bypass aspects of Microsoft’s remediation for the Microsoft Defender elevation-of-privilege flaw CVE-2026-69414, also called ShieldBreak. The researcher claims the exploit works on fully patched Windows 10, Windows 11, and Windows Server systems, including systems with September 2026 updates, to perform arbitrary file reads under SYSTEM privileges.
Microsoft had said Malware Protection Engine version 1.1.26080.3, delivered through automatic engine and malware-definition updates, fixed ShieldBreak. The claimed bypass has not been independently verified, and available reporting indicates ShieldCrash demonstrates SYSTEM-level file-read access rather than arbitrary writes or a complete SYSTEM compromise; the release occurred amid a dispute over Microsoft’s bug-bounty and vulnerability-disclosure practices.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
On September 9, Chaotic Eclipse/Nightmare Eclipse released ShieldCrash, a proof of concept claimed to bypass an incompletely remediated ShieldBreak condition on fully updated supported Windows systems. The PoC reportedly provides arbitrary file reads as SYSTEM but not write access; the bypass claim was not independently verified.
Microsoft addressed ShieldBreak, CVE-2026-69414, an elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine, through its September 2026 security updates and Malware Protection Engine version 1.1.26080.3.
Microsoft patched the RoguePlanet Microsoft Defender flaw.
Nightmare Eclipse disclosed RoguePlanet, an earlier Microsoft Defender vulnerability later described as the issue that ShieldBreak bypassed.
Since April 2026, Nightmare Eclipse disclosed multiple zero-days affecting Microsoft Defender, BitLocker, and other Windows components, including ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend.
Testing found the published ShieldCrash proof of concept reaches several Defender and race-synchronization stages but fails its final namespace redirect because Defender retains a CLFS log file in the working directory. Files presented as reads of SAM, SECURITY, and ELAM were instead ntdll.dll copies placed by the PoC in an NTFS alternate data stream, so the analysis did not validate the claimed arbitrary-file-read primitive.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
17 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcesocradar.io
Open sourcemalware.news
Open sourcexakep.ru
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourcegithub.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researcher **Chaotic Eclipse** has released a proof-of-concept exploit dubbed **ShieldBreak** that allegedly bypasses Microsoft’s fix for `CVE-2026-50656`, also known as **RoguePlanet**, in **Microsoft Defender for Windows**. The flaw affects the **Microsoft Malware Protection Engine** and has been described as a local privilege escalation race condition that can let an attacker with local access spawn a **SYSTEM-level shell** and execute arbitrary code. The researcher said the bypass works reliably on **Windows 11 25H2** and **Windows Server 2025**, and that **Windows 10** is also believed to be vulnerable. Microsoft had issued updates for the RoguePlanet zero-day after acknowledging it earlier, but the new claims suggest the patch was incomplete. The disclosure adds to ongoing scrutiny of Microsoft’s recent security fixes and follows earlier public zero-day releases by the same researcher, including **LegacyHive**, amid a broader dispute over coordinated vulnerability disclosure. Separate reporting also noted that Microsoft recently patched hundreds of flaws and that **CISA** added `CVE-2026-68820`, an actively exploited WinSock driver issue, to its **Known Exploited Vulnerabilities** catalog with a remediation deadline for U.S. federal agencies.
Aug 17, 2026
NightmareEclipse released **ShieldBreak**, a proof-of-concept local privilege-escalation exploit claimed to bypass Microsoft’s fix for **CVE-2026-50656** (RoguePlanet). The exploit allegedly abuses improper link resolution during Windows Defender remediation, combining Cloud Files placeholders, Object Manager symbolic-link swaps, CLFS path handling, an EICAR-triggered scan, and NTFS alternate data streams to redirect a Defender process running as `SYSTEM` and plant `C:\Windows\System32\phoneinfo.dll`. A fabricated Windows Error Reporting report and the `QueueReporting` scheduled task then cause `wermgr.exe` to load the malicious DLL; the included `Warden.dll` payload reportedly duplicates a SYSTEM token and opens a SYSTEM shell in the unprivileged user’s session. Splunk published attack data and multiple disabled-by-default analytics for the ShieldBreak chain, covering Defender activity on `\globalroot\` object-manager paths (Defender Operational events 1116/1117), `MpClient.dll` loaded by non-Defender processes, ADS creation through loopback administrative SMB shares (Security event 5145), manually created `.wer` files in the Windows Error Reporting ReportQueue, creation of phantom DLLs such as `phoneinfo.dll` in system paths, and `WerMgr.exe` spawning SYSTEM-integrity children. Organizations should collect the required Sysmon, Security, and Defender Operational telemetry; enable file-share object-access auditing; investigate these signals promptly; and validate the creating process, signer, file hash, and operational need before suppressing alerts.
Aug 28, 2026
A publicly disclosed zero-day dubbed **ShieldBreak** (`CVE-2026-69414`) allows a local attacker with limited privileges to escalate to **SYSTEM** on Windows systems where Microsoft Defender is enabled. Reporting says the flaw affects the **Microsoft Malware Protection Engine** and serves as a bypass of Microsoft’s earlier fix for **RoguePlanet** (`CVE-2026-50656`), indicating the prior remediation was incomplete. Microsoft has acknowledged the issue and said it is working on a patch, but no release date has been announced. Technical analysis shows the exploit chains **Cloud Files** abuse, **NT Object Manager** namespace manipulation, direct use of Defender functionality through `MpClient.dll`, a remediation timing race, and **Windows Error Reporting** task abuse to coerce Defender into writing an attacker-controlled DLL to `C:\Windows\System32\phoneinfo.dll`, which is then executed by `wermgr.exe` as SYSTEM. Researchers reproduced the proof of concept on fully patched **Windows 11 24H2** and **Windows Server 2025** systems with default Defender settings, with elevation reportedly occurring in roughly eight to twelve seconds; key detection opportunities include creation of `phoneinfo.dll` in `System32`, `MpClient.dll` loading by non-Defender processes, suspicious activity under `\BaseNamedObjects\Restricted\`, and `wermgr.exe` loading the planted DLL.
Aug 20, 2026