If you lead an organization then you should be aware that the antivirus software running on most Windows computers, Microsoft Defender, has a flaw that lets someone who has already gotten a foothold on a machine take it over completely. Worse, Microsoft already tried to fix a related version of this problem last month, and a researcher has now published working proof that the fix did not close the door. There is no patch for this specific bypass, yet. If your organization runs Windows, this is worth your security team's attention today, not next month.
The technical details are below, if you wish to pass this information on to your security team. We'll also provide suggestions on what to do in the meantime, since "wait for Microsoft" is not a tenable option.
What happened
On August 11, 2026, a security researcher operating under the handle Nightmare Eclipse (also known online as Chaotic Eclipse, INFINITE NIGHTMARE, and MSNightmare) published a proof-of-concept exploit called ShieldBreak that targets Microsoft Defender, the built-in antivirus and endpoint protection engine on Windows 10, Windows 11, and Windows Server. Yes, this is the same researcher we've mentioned in previous articles who continues to drop information on vulnerabilities in Microsoft products the same day, but within hours after, Microsoft's Patch Tuesday is announced.
ShieldBreak is not, strictly speaking, a brand-new vulnerability class. It's presented by its author as a complete bypass of a patch Microsoft shipped in July 2026 for a different Defender flaw known as RoguePlanet, tracked as CVE-2026-50656. No CVE identifier has yet been assigned to ShieldBreak itself, and as of this writing Microsoft has not released a fix. The company's statement to press outlets has been consistent: it is "aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims."
That statement is measured, but several independent researchers have already gone further. Kevin Beaumont, who publishes widely used Microsoft Defender for Endpoint detection content, and Will Dormann, principal vulnerability analyst at Tharros, have both confirmed the exploit works, on at least Windows 11.
Background: what was RoguePlanet, and why does it matter here?
To understand ShieldBreak, it helps to understand the bug it claims to bypass.
RoguePlanet was disclosed by the same researcher in June 2026. It was a race condition, a timing bug, in mpengine.dll, the Microsoft Malware Protection Engine that powers Defender's file-scanning logic. Exploited successfully, it let a local attacker win a narrow "check, then act" timing window during a file scan and redirect that scan into spawning a command shell running as NT AUTHORITY\SYSTEM, the highest privilege level on a Windows machine.
Microsoft rated RoguePlanet "Exploitation More Likely" with a CVSS score of 7.8 and patched it in Malware Protection Engine version 1.1.26060.3008, part of the July 2026 update cycle, roughly a month after the researcher's initial disclosure.
According to Nightmare Eclipse, that fix closed only one narrow path into the underlying weakness, not the weakness itself. ShieldBreak is offered as proof: a working exploit that reaches SYSTEM-level access through Defender via a different technical route, on machines that already have the RoguePlanet patch installed.
How ShieldBreak works
Security researcher Kevin Beaumont has been explicit that the two exploits are mechanically different, not variations on the same trick:
"RoguePlanet was a filesystem race condition vuln that uses virtual disks and NT native file manipulation to trick quarantine process into overwriting system files. ShieldBreak [uses a] user-mode callback hook to change file contents during a Defender cloud-hydration scan via cfapi (Cloud Filter API)."
Will Dormann independently walked through the exploit chain in more detail. The sequence, as he described it, is:
- Plant a benign test file. The attacker drops an EICAR file, an industry-standard string used to safely trigger antivirus detection, to get Defender's attention.
- Redirect the scan path. Using Object Manager symlinks, the attacker manipulates where Defender believes it is scanning, pointing it at the
system32directory. - Swap files mid-scan. While the scan is in progress, the attacker uses CLFS (the Common Log File System) to substitute the identity file and hydration data Defender is working with, placing attacker-controlled content at
C:\Windows\system32\phoneinfo.dll, a file that does not exist by default on Windows. - Trigger a scheduled task. The attacker runs the built-in
QueueReportingscheduled task, which executeswermgr.exe -uploadwith the highest available privileges. - Let Windows do the rest. Windows Error Reporting's
wer.dllcontains code that explicitly loadsphoneinfo.dllif it is present. Because the attacker's file now occupies that path, it loads and executes, spawningconhost.exewith SYSTEM privileges.
In Dormann's words: "I don't recall RoguePlanet doing anything with cloud providers, CLFS, hydration, [or] phoneinfo.dll, and unlike RoguePlanet, ShieldBreak seems to require Defender to be active to work."
That last point matters for scoping your exposure: ShieldBreak requires Microsoft Defender to be enabled and actively scanning. It does not work against a machine where Defender's real-time or cloud-delivered protection has been switched off, though disabling those protections is not a mitigation we'd recommend given what Defender is there to do.
What an attacker can actually do with this
ShieldBreak is a local privilege escalation exploit, not a remote one. An attacker needs some existing access to the machine first, typically a foothold gained through phishing, a compromised account, or another vulnerability. From that limited starting point, ShieldBreak turns an ordinary low-privilege session into full SYSTEM-level control.
The researcher's own claims are notable for their specificity: "The PoC was tested in the latest version of Windows 11 25H2 (+Canary channel) and Windows Server 2025, the PoC also have a 100% success rate." Windows 10 and its corresponding server editions are described as vulnerable as well, though the current public proof-of-concept does not officially target them.
A 100 percent success rate is unusual for a race-condition-style exploit, which typically requires multiple attempts to win a timing window. If that claim holds up under further scrutiny, it raises the stakes considerably: a reliable local privilege escalation chain against Defender itself is a valuable second-stage tool for ransomware operators and any attacker doing hands-on-keyboard intrusion work, precisely because it abuses the security product that is supposed to be watching for exactly this kind of behavior.
Who is affected
Based on the researcher's testing and independent confirmation so far:
- Windows 11 25H2, including the Canary preview channel: confirmed vulnerable, PoC validated by multiple independent researchers.
- Windows Server 2025: confirmed vulnerable per the researcher's testing.
- Windows 10 and corresponding Server editions: described by the researcher as vulnerable, but not officially supported by the current public PoC.
- Any of the above with the July 2026 RoguePlanet patch already installed are still exposed. Installing that update does not close this path.
The one hard precondition is that Microsoft Defender must be enabled and performing active scans, including cloud-delivered (cloud-hydration) scanning, for the exploit chain to function.
The context: an ongoing, public fight between the researcher and Microsoft
It is worth understanding the backdrop here, because it affects both the reliability of what's being reported and the likely pace of a fix.
Nightmare Eclipse has been disclosing Windows and Defender vulnerabilities outside Microsoft's coordinated disclosure process since around April 2026, with ShieldBreak reportedly the ninth release in that series (prior entries include LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, and MiniPlasma, among others). Several of those flaws were later patched by Microsoft; others remain outstanding.
In May 2026, Microsoft published a blog post warning of possible legal action against researchers who release zero-day details outside its disclosure policy, a post widely read as directed at Nightmare Eclipse specifically. The move drew significant criticism from the security research community, and Microsoft subsequently softened its tone in a follow-up social media post, though the original blog post remains published and unchanged. GitHub and GitLab have also suspended accounts associated with the researcher, pushing releases onto alternative hosting.
None of this changes the technical facts on the ground, and outside researchers with no stake in the dispute, Beaumont and Dormann among them, have independently reproduced the exploit's behavior. But it is a reasonable factor in how quickly and how publicly Microsoft may respond, and it is the reason patch timing here is less predictable than usual.
ShieldBreak's release also lands one day after Microsoft's August 2026 Patch Tuesday, which addressed roughly 400 vulnerabilities across its products, including an actively exploited zero-day in the Windows Ancillary Function Driver for WinSock (CVE-2026-68820, added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of August 25, 2026, for federal agencies) and a privilege escalation flaw in the Windows User Profile Service (CVE-2026-62832, disclosed last month by this same researcher under the name LegacyHive). Security teams already working through that patch cycle now have a second, unpatched issue to track in parallel.
What should you do?
Because there is currently no official patch for ShieldBreak, the guidance here is defense-in-depth rather than "update and move on." Several security professionals have weighed in with specific, practical recommendations since the PoC's release.
1. Do not assume the RoguePlanet patch protects you
If your organization applied Microsoft's July 2026 fix for CVE-2026-50656 and considered that item closed, revisit that assumption. ShieldBreak's entire premise is that the underlying weakness in the Malware Protection Engine was not fully remediated. Treat this as an open exposure regardless of your patch level for RoguePlanet.
2. Deploy application allowlisting in enforced mode
Multiple analysts have pointed to Windows Defender Application Control (WDAC) or AppLocker, run in enforced (not audit) mode, as the strongest available hardening against this exploit chain. Because ShieldBreak ultimately depends on getting attacker-controlled code to execute as a trusted system component, a properly enforced allowlist can stop the payload from running even if the earlier steps in the chain succeed.
3. Tighten local administrative rights
Reduce the number of accounts with local admin privileges and enforce least-privilege access broadly. ShieldBreak escalates an existing foothold; the less privilege an attacker starts with, the less there is to escalate from, and the more steps an attacker needs to chain together to reach a useful outcome.
4. Deploy detection coverage now
Kevin Beaumont has published Microsoft Defender Advanced Hunting queries specifically for ShieldBreak detection, available at his ThreatHunting GitHub repository. If your organization uses Microsoft Defender for Endpoint, incorporate these queries into your hunting and alerting workflow while you evaluate broader exposure.
5. Watch specifically for SYSTEM-level shells spawned by Defender's own process
The single highest-fidelity indicator flagged by analysts reviewing this exploit: an interactive shell or scripting host (such as conhost.exe, cmd.exe, or powershell.exe) running as SYSTEM whose parent process is MsMpEng.exe, Defender's core engine process. That parent-child relationship should not occur in a healthy environment under normal operation, and its presence is a strong signal that this exploit chain, or something using a similar mechanism, has run on the host.
6. Monitor for the specific artifacts in the exploit chain
Given the technical breakdown above, detection and endpoint teams should also watch for:
- Unexpected creation of
C:\Windows\system32\phoneinfo.dllor similar unexpected files appearing insystem32. - Unusual Object Manager symbolic link creation targeting system directories.
- Anomalous CLFS (Common Log File System) activity coinciding with a Defender scan.
- Unexpected manual or scripted invocation of the
QueueReportingscheduled task.
7. Track Microsoft's response and apply the eventual fix promptly
Given the timing relative to August's Patch Tuesday, a fix may not arrive until Microsoft's next regular update cycle in September, unless Microsoft treats this as severe enough to warrant an out-of-band release. Monitor the Microsoft Security Response Center update guide for developments, and apply whatever fix is issued as soon as it becomes available.
A note on trusting your security tooling as the sole line of defense
There's a broader lesson in ShieldBreak worth sitting with, independent of whether every detail of the PoC holds up to further scrutiny. The exploit does not attack a weakness in some obscure Windows subsystem; it attacks the antivirus engine itself, the tool an organization relies on both to prevent compromise and to tell it whether a compromise has happened. When the security control and the evidence that the control is working come from the same source, a bypass like this one is doubly damaging: it can succeed quietly, and the very system meant to flag it may be the one being abused.
That is not a reason to disable Defender. It is a reason not to treat any single endpoint control, however central, as sufficient on its own. Layered defenses, allowlisting, least privilege, and independent detection and monitoring remain necessary precisely for moments like this one, when a trusted control turns out to have a gap.
Summary
| Name | ShieldBreak |
| CVE | None assigned yet |
| Underlying/related CVE | CVE-2026-50656 ("RoguePlanet," CVSS 7.8) |
| Type | Local Privilege Escalation (patch bypass) |
| Component | Microsoft Defender / Malware Protection Engine, via Cloud Filter API (cfapi) |
| Disclosed by | Nightmare Eclipse (aka Chaotic Eclipse, INFINITE NIGHTMARE, MSNightmare), August 11, 2026 |
| Affected | Windows 11 25H2 (+Canary), Windows Server 2025 confirmed; Windows 10 and Server equivalents reported vulnerable but not officially PoC-supported |
| Precondition | Microsoft Defender must be enabled with active scanning |
| Prior patch bypassed? | Yes, claims to fully bypass the July 2026 fix for RoguePlanet |
| Independent verification? | Yes, by Kevin Beaumont and Will Dormann (Tharros) |
| Public PoC? | Yes, published on GitHub and mirrored across several hosts |
| Official Microsoft patch? | Not yet available; Microsoft says it is investigating |
| Immediate mitigation | WDAC/AppLocker in enforced mode, least-privilege hardening, detection queries, monitor for SYSTEM shells spawned by MsMpEng.exe |
If you need help assessing your exposure to ShieldBreak, deploying the available detection queries, or hardening your endpoint fleet while a patch is pending, get in touch. An unpatched bypass against the very software meant to protect your endpoints deserves a fast, layered response, and that is exactly the kind of situation CrowdSOC was built for.