Loading vulnerability…
CVE-2026-69414, publicly known as ShieldBreak, is a local elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender. A low-privileged authenticated attacker can abuse Defender's privileged file-processing behavior to elevate from a standard-user context to SYSTEM. Public technical reporting associated the original exploitation path with Cloud Filter API operations during cloud-file hydration. Microsoft remediated ShieldBreak in Microsoft Malware Protection Engine version 1.1.26080.3. Subsequent public ShieldCrash claims allege an incomplete remediation, but Microsoft has not confirmed a separate bypass vulnerability; independent testing found the released ShieldCrash proof of concept did not demonstrate the claimed arbitrary SYSTEM file-read primitive.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
ShieldCrash is a small Visual Studio C++20 console-project repository centered on the 52 KB ShieldCrash.cpp source file. It claims a residual Microsoft Defender Antivirus vulnerability related to CVE-2026-69414 (“ShieldBreak”) and implements a local proof of concept for reading an arbitrary file through a SYSTEM-context Defender processing path. The visible tail of the source derives an output filename from the requested input path and a GUID, creates a destination file, uses file mappings and memmove to copy the obtained content, and deletes a staged object with NtDeleteFile. The source imports native Windows APIs and libraries including ntdll, Cloud Files (CldApi), Task Scheduler, KTM, Shlwapi, and Winsock; named synchronization objects and variables indicate a WebDAV-related staging/coordination component. No fixed remote host, URL, IP address, or command-and-control endpoint is visible in the supplied code. The project references ZIP and DLL resources (eicar_com.zip and Warden.dll), although the declared ShieldCrash.rc resource script and those two input artifacts are absent from the supplied eight-file archive, so a clean build may be incomplete. This is not a detection-only script and contains no reverse-shell or SYSTEM code-execution payload; its stated and code-supported objective is local data disclosure.
ShieldBreak is a standalone Visual Studio C++20 console project, not a known exploitation framework module. Its primary implementation is ShieldBreak.cpp (about 47 KB); the remaining listed files are Visual Studio solution/project metadata, a resource-ID header, README, and license. The project is configured for Win32 and x64 Debug/Release builds and links against ntdll, CldApi, onecore, and Task Scheduler libraries. The source defines Microsoft Defender-related internal data types and uses Windows Cloud Files APIs, COM Task Scheduler interfaces, Windows Error Reporting task execution, resource extraction, and a named pipe. It embeds or expects ZIP and DLL resources and cleans up the synchronization root, WER files/directories, scan target, and pipe after execution. No remote host, URL, IP address, DNS name, or external C2 endpoint is present in the supplied code. The project metadata references ShieldBreak.rc plus several binary/resource inputs that are absent from the eight-file listing, meaning the repository as provided may not build without those missing artifacts. The README attributes the technique to CVE-2026-50656 and claims a Defender patch bypass, but the claim and the behavior of the unavailable embedded DLL cannot be independently verified from the supplied contents.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
92 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Patched Microsoft Defender privilege-escalation vulnerability.
ShieldBreak is a previously patched Microsoft Defender for Windows vulnerability whose September 2026 fix is reported to have missed a code path, enabling the related ShieldCrash issue.
A Microsoft Defender vulnerability representing a bypass of the RoguePlanet patch. It was disclosed in August 2026 and patched on September 3, 2026, but its patch was subsequently bypassed by ShieldCrash.
A high-severity (CVSS 7.8) local elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine. The reported ShieldCrash bypass allegedly retains a path for low-privileged local attackers with an existing foothold to induce privileged Defender file processing and read protected files as SYSTEM. The article states the PoC does not demonstrate arbitrary writes, remote exploitation, or SYSTEM-level code execution, and Microsoft has not confirmed the bypass.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.