Description:
ShieldBreak is a proof-of-concept exploit, published by the researcher known as Nightmare Eclipse (also Chaotic Eclipse) on 12 August 2026, that turns Microsoft Defender itself into a privilege-escalation tool: a standard, low-privileged user can trick the Malware Protection Engine (mpengine.dll) into spawning a shell running as NT AUTHORITY\SYSTEM, giving full control of the machine and its data.
Technically, ShieldBreak is a full bypass of Microsoft's fix for the earlier "RoguePlanet" flaw, CVE-2026-50656 — a check-then-act race condition in Defender's file scanning. Microsoft's July 2026 remediation (Malware Protection Engine 1.1.26060.3008) closed only one route into the vulnerable code; ShieldBreak reaches the same race through a different path, using a user-mode callback hook to swap a file's contents while Defender performs a cloud-hydration scan via the Cloud Filter API (cfapi).
The researcher reports a near-100% success rate on fully patched Windows 11 25H2 and Windows Server 2025, with Windows 10 and other Server editions also believed vulnerable. The exploit requires local access and the victim to run the PoC application, and Defender must be enabled — but Defender is on by default on most Windows installs, so the exposed population is very large. The disclosure is part of the researcher's ongoing retaliatory campaign against Microsoft, published after Microsoft reportedly threatened legal action.
Steps to reproduce:
- On a fully patched Windows system with Microsoft Defender enabled, log in as an ordinary non-administrative user.
- Run the ShieldBreak proof-of-concept application.
- The PoC installs a user-mode callback hook and stages a file handled through the Cloud Filter API (cfapi).
- Defender's engine hydrates and scans the file; the hook swaps its contents inside the check-then-act window.
- The race is won and a shell is spawned as NT AUTHORITY\SYSTEM.
Workaround: No vendor workaround exists. Interim hardening recommended by responders: verify Defender engine versions across the estate, enable Tamper Protection, restrict local administrative rights and interactive logons on shared machines, deploy application allowlisting so an unsigned PoC-style binary can't run, apply Attack Surface Reduction rules, and monitor for anomalous MsMpEng.exe behaviour and unexpected SYSTEM shells.
Severity: Critical (unpatched local privilege escalation to SYSTEM on fully patched, default-configured Windows, public exploit code, near-100% reliability, and no vendor fix or true workaround; mitigated only by the need for local access and user execution)
First seen: 12 August 2026
Affected product: Microsoft Defender Antivirus (Windows)
Affected platforms: Windows 10, Windows 11 (confirmed on 25H2 including Canary), and Windows Server (confirmed on Server 2025) with Defender enabled
Affected versions: Microsoft Malware Protection Engine up to and including 1.1.26060.3008 — i.e. systems patched for CVE-2026-50656 remain exploitable
Fixed versions: Not yet available
Links:
- https://arcticwolf.com/resources/blog/cve-2026-50656-rogueplanet-shieldbreak/ (August 2026)
- https://www.bleepingcomputer.com/news/security/new-microsoft-defender-shieldbreak-zero-day-grants-system-privileges/ (12 August 2026)
- https://www.theregister.com/cyber-crime/2026/08/12/microsoft-vendetta-hacker-has-a-new-zero-day-that-gives-system-privileges-on-fully-patched-windows/5286889 (12 August 2026)
- https://techcrunch.com/2026/08/12/after-microsoft-threatened-legal-action-a-security-researcher-publishes-a-new-windows-zero-day-bug/ (12 August 2026)
- https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html (August 2026)
- https://cybersecuritynews.com/nightmare-eclipse-drops-shieldbreak-0-day/ (August 2026)