Microsoft Developing Patch for Defender ShieldBreak Zero-Day
Summary
Microsoft is preparing a patch for Defender flaw CVE-2026-69414. Nightmare Eclipse says its PoC bypasses the RoguePlanet fix; Will Dormann confirmed it works but said Defender must be enabled. Microsoft says it is investigating the claims.
Key points
- Microsoft tracks the Defender elevation-of-privilege flaw ShieldBreak as CVE-2026-69414 and says it is working on a security update; no patch is available yet.
- Nightmare Eclipse published a PoC, claiming local users with limited permissions can gain SYSTEM privileges on fully patched Windows systems by bypassing the RoguePlanet fix.
- Vulnerability analyst Will Dormann confirmed the exploit works, but said Microsoft Defender must be enabled for privilege escalation.
- Microsoft said it is investigating the reported vulnerability's validity and potential applicability.
- The researcher said the PoC was tested on Windows 11 25H2 and Windows Server 2025; the article says Windows 10 and related server editions are also vulnerable, though not supported by the PoC.
Article Details
- Vulnerability Types
- Local privilege escalation
- Security patch bypass
- Severity
- Unknown
- Affected Versions
- Windows 10
- Windows 11
- Windows 11 25H2
- Windows Server 2025
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- unavailable
MITRE ATT&CK
CVE
CVE-2026-50656“Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass,” Nightmare Eclipse said.CVE-2026-69414Microsoft has confirmed it is working on a patch for ShieldBreak, a newly disclosed Microsoft Defender zero-day tracked as CVE-2026-69414.
People
Nightmare EclipseSecurity researcher who disclosed ShieldBreak and published its proof-of-concept exploit; the article reports the disclosure was made without prior notice to Microsoft.Will DormannVulnerability analyst who confirmed the ShieldBreak exploit works and noted that Microsoft Defender must be enabled for privilege escalation.
Vendors
Products
Microsoft Defender Antimalware PlatformMicrosoft has confirmed it is working on a patch for ShieldBreak, a newly disclosed Microsoft Defender zero-day tracked as CVE-2026-69414.Windows 10that local attackers with limited permissions can use to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems.Windows 11local attackers with limited permissions can use to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems.Windows Serverlimited permissions can use to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems.