www.it-connect.fr
ShieldCrash: New Microsoft Defender Zero-Day Grants SYSTEM-Level File Access
ShieldCrash is the name of the new zero-day exploit that allows anyone to read any file with SYSTEM privileges on a fully up-to-date Windows machine. Its author is a name you may already know: Nightmare Eclipse. Here’s what we know so far.
This is becoming a habit: Nightmare Eclipse reveals a zero-day flaw in Windows, Microsoft releases a patch, and then, shortly afterward, he releases a bypass for Microsoft’s patch (or a different new exploit). This researcher has made a habit of waiting for monthly updates before publishing his findings, so they remain exploitable for a month, unless Microsoft releases an out-of-band security patch in the meantime. But the goal is clear: to disrupt Microsoft.
That is exactly what happened this week. On Tuesday, September 8, Microsoft released its September 2026 Patch Tuesday, and the ShieldCrash exploit followed soon after. In reality, ShieldCrash exploits the same security issue as ShieldBreak, a flaw Microsoft had recently patched. And as I explained in August, ShieldBreak was already a bypass for the fix released in July for RoguePlanet, another Microsoft Defender flaw disclosed in June. So this is the third chapter in the series....
As a reminder, ShieldBreak is a vulnerability that allows privilege escalation through the Microsoft Malware Protection Engine (Microsoft Defender). Disclosed on August 12, 2026, it was assigned by Microsoft the identifier CVE-2026-69414. However, the patch for ShieldBreak arrived a little before Patch Tuesday: on Thursday, September 3, 2026 to be exact, via a malware protection engine update (version 1.1.26080.3). This automatically deployed update did not hold up for long.
What ShieldCrash Does
According to the GitHub repository published by Nightmare Eclipse, ShieldCrash exploits the same issue as ShieldBreak, in a configuration that Microsoft apparently forgot to address.
"Microsoft did not properly fix ShieldBreak CVE-2026-69414. Under specific conditions, it is still possible to trigger exactly the same issue caused by ShieldBreak. Microsoft fixed several things to prevent a new exploitation, but missed one place where ShieldBreak can still be exploited", the researcher explains.
The PoC exploit code published by the researcher is functional but limited, so as not to expose Windows users too much. As it stands, here is what the ShieldCrash exploit available on GitHub allows:
- Arbitrary file read as SYSTEM. The PoC allows any file on the system to be read with the highest local privilege level. That is already enough to recover secrets stored on the machine.
- No writing. Unlike ShieldBreak, the current version does not grant write access, and therefore no full SYSTEM shell.
- All supported versions of Windows would be affected, including Windows 10, Windows 11, and Windows Server, even with the September 2026 updates installed.
The researcher does not hide the fact that this PoC is a base that may evolve. "I could rework this later into a full SYSTEM PoC, but for now I’m publishing this skeleton PoC because I’m a bit lazy", he writes in the README file.
As with ShieldBreak, this flaw is locally exploitable: an attacker must already have access to the machine, for example with a standard user account. In addition, Defender must be enabled. In any case, there is no patch for this flaw.
Finally, let us close by noting that the standoff between Nightmare Eclipse and Microsoft is starting to drag on. Since April 2026, the researcher has published around a dozen zero-days without notifying the vendor: LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, UnDefend, then ShieldBreak and now ShieldCrash. Let us not forget that Nightmare Eclipse has also expanded his scope. I wrote about this two days ago with the FalconFlank flaw targeting CrowdStrike Falcon, and other PoCs concern Kaspersky, Avast, and NVIDIA.
