cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

ShieldBreak Exploit Reportedly Bypasses Patched Defender Flaw to Gain SYSTEM Privileges

· Original article ↗

Summary

Nightmare Eclipse disclosed ShieldBreak, a Microsoft Defender exploit said to bypass patched RoguePlanet (CVE-2026-50656) and elevate privileges to SYSTEM on Windows. Will Dormann reportedly confirmed it works when Defender is enabled.

Key points

  • Nightmare Eclipse disclosed ShieldBreak as a bypass for RoguePlanet, which Microsoft patched in July.
  • The exploit is said to elevate privileges to SYSTEM on fully patched Windows systems.
  • Will Dormann reportedly confirmed the exploit works and said Microsoft Defender must be enabled.
  • Nightmare Eclipse said the proof of concept was tested on Windows 11 25H2 and Windows Server 2025; the researcher described Windows 10 and related server editions as vulnerable but unsupported by the PoC.
  • The disclosure is part of an ongoing dispute between Microsoft and Nightmare Eclipse over vulnerability disclosure and bug bounty practices.

Article Details

Vulnerability Types
  • Microsoft Defender privilege escalation
  • Patch bypass
Affected Versions
  • Windows 11 25H2
  • Windows Server 2025
Exploitation Status
reported
Exploit Availability
public_poc
Patch Status
unavailable

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationShieldBreak exploits a Microsoft Defender vulnerability to elevate privileges to SYSTEM.

CVE

CVE-2026-50656“Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass,” they said.

People

Nightmare EclipseSecurity researcher who released the ShieldBreak proof of concept and reported that it bypasses the patch for RoguePlanet.Will DormannPrincipal vulnerability analyst at Tharros who confirmed the exploit works and that Microsoft Defender must be enabled for it to escalate privileges.

Vendors

MicrosoftNightmare Eclipse has released ShieldBreak, a new Microsoft Defender zero-day exploit that bypasses the patched RoguePlanet flaw and can elevate attackers to SYSTEM privileges on fully patched Windows systems.

Products

Microsoft Defender Antimalware PlatformNightmare Eclipse has released ShieldBreak, a new Microsoft Defender zero-day exploit that bypasses the patched RoguePlanet flaw and can elevate attackers to SYSTEM privileges on fully patched Windows systems.Windows 10The exploit can grant SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems.Windows 11The exploit can grant SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems.Windows ServerThe exploit can grant SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems.

Tools

ShieldBreakNightmare Eclipse has released ShieldBreak, a new Microsoft Defender zero-day exploit that bypasses the patched RoguePlanet flaw and can elevate attackers to SYSTEM privileges on fully patched Windows systems.

Related Articles