Microsoft Races to Patch ShieldBreak Zero-Day Bypassing Defender on Windows
Microsoft confirms it is working on a security patch for a zero-day vulnerability in Microsoft Defender known as "ShieldBreak." Security researcher Nightmare Eclipse publicly discloses the flaw, describing it as a full bypass of the RoguePlanet privilege escalation vulnerability (CVE-2026-50656) that Microsoft patched inadequately in June. The company now tracks the new flaw as CVE-2026-69414 and says a security update is in development.
Nightmare Eclipse releases a proof-of-concept exploit that local attackers with limited permissions can use to gain SYSTEM privileges on fully patched Windows 11, Windows Server 2025, and Canary channel builds. The researcher reports a 100% success rate in testing and notes that Windows 10 and its server editions are also vulnerable. Vulnerability analyst Will Dormann confirms the exploit works but adds that Microsoft Defender must be enabled for the privilege escalation to succeed.
Microsoft says it is committed to investigating security issues and protecting customers as soon as possible, though it has not yet acknowledged Nightmare Eclipse as the finder or provided a release date for the fix. The disclosure arrives without prior notice to Microsoft, following the August 2026 Patch Tuesday updates. Organizations are advised to monitor for the upcoming patch and ensure Defender deployments remain current in the meantime.