www.it-connect.fr
ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Fix
Researcher Nightmare Eclipse has released ShieldBreak, a new Windows exploit that he presents as a bypass for the patch for the RoguePlanet flaw. By using this new attack, it is possible to obtain SYSTEM privileges on Windows machines that are otherwise fully up to date. Microsoft has now assigned a reference to this new flaw, CVE-2026-69414, and says it is working on a patch. Here is what you need to know.
It is becoming a habit... A few hours after the release of the August 2026 Patch Tuesday and its 421 fixed vulnerabilities, Nightmare Eclipse published a new exploit: ShieldBreak. Its target: Microsoft Defender, once again. And this is not the first time he has disclosed a flaw right after a Patch Tuesday release.
Before talking about the ShieldBreak flaw, let us rewind for a moment. In June 2026, this same researcher had revealed RoguePlanet, a zero-day flaw in Microsoft Defender that allowed SYSTEM privileges to be obtained. Microsoft then fixed this vulnerability, CVE-2026-50656, on July 8, 2026 by releasing a new version of its protection engine.
Case closed? Well, no.
A complete bypass of the RoguePlanet patch
On his blog, Nightmare Eclipse claims that "Microsoft did not properly fix the RoguePlanet vulnerability" and presents his new exploit code as a way to bypass the patch developed by the Redmond company. He also claims that his exploit works every time, whether on Windows 11 25H2 (including on the Canary channel) or Windows Server 2025.
"Please note that Windows 10 (and its server editions) are not currently supported; however, they are also vulnerable to ShieldBreak," he says about the PoC posted on GitHub and elsewhere.
ShieldBreak allows any Windows user to obtain SYSTEM privileges on a vulnerable machine.
Following the disclosure of this new exploit, Will Dormann, principal vulnerability analyst at Tharros, tested it. He then confirmed that the exploit worked, while adding that Microsoft Defender had to be active on the Windows machine for the privilege escalation to succeed. The same response came from Kevin Beaumont via Mastodon: "They call it ‘RoguePlanet 2,’ but it works very differently. I tested it, and it works on the latest version of Windows 11."
Indeed, Kevin Beaumont explains that RoguePlanet relied on a file-system race condition, using virtual disks to trap the quarantine process. ShieldBreak takes a different route and would rely on a user-mode callback hook to alter the contents of a file during a cloud hydration scan through the cfapi API (Cloud Filter API).
CVE-2026-69414: Microsoft acknowledges the flaw
On Friday, August 14, 2026, Microsoft published a security bulletin and assigned the CVE-2026-69414 reference to this vulnerability nicknamed ShieldBreak. The Redmond company describes it as a privilege escalation issue in the Malware Protection Engine component, the Defender engine, and confirms that it is working on a security fix.
As of the time of writing, there is no fix for the ShieldBreak flaw, which has a CVSS score of 7.8 out of 10. Although it is not yet being exploited, it is now public and exploit code is available.
Proof that tensions are still high between Microsoft and the researcher: in its bulletin, Microsoft mentions the flaw "publicly referred to as ShieldBreak", but does not credit Nightmare Eclipse for the discovery. This is not new, since for previous flaws Microsoft credited an anonymous researcher instead (a situation that has continued since April 2026).
While waiting for the patch, what should you do?
ShieldBreak is a local privilege escalation. That means an attacker must already have access to the machine to exploit it. It is not an initial access vector, but rather a way to compromise a machine that the attacker can already access.
So, what can you do to protect yourself? Here are a few ideas.
- Prevent the execution of unapproved code on endpoints. Several methods are available on Windows, including AppLocker and WDAC.
- Monitor abnormal behavior related to the Defender engine. The KQL queries published by Kevin Beaumont for Defender for Endpoint may help.
- Be ready to deploy the protection engine update as soon as it is released. For RoguePlanet, the fix came through a new version of the Microsoft Malware Protection Engine, outside the usual monthly cycle: the update can therefore arrive at any time.
