ShieldBreak Zero-Day Grants SYSTEM Access on Fully Patched Windows

Microsoft Defender zero-day vulnerability ShieldBreak can reportedly grant attackers SYSTEM privileges on fully patched Windows systems.

Security researcher Nightmare Eclipse disclosed ShieldBreak as a bypass for RoguePlanet, a Microsoft Defender privilege escalation flaw tracked as CVE-2026-50656.

Microsoft patched RoguePlanet in July, but the researcher claims the fix does not fully address the underlying issue.

ShieldBreak affects fully patched Windows systems

Nightmare Eclipse says ShieldBreak works on fully updated Windows 11 and Windows Server installations.

The researcher tested the vulnerability on Windows 11 25H2, Windows Insider Canary builds, and Windows Server 2025. Windows 10 and corresponding Windows Server versions are also reportedly affected.

Vulnerability analyst Will Dormann independently confirmed that the privilege escalation works.

Microsoft Defender must be enabled on the targeted system for the exploit to function. Successful exploitation can reportedly give an attacker SYSTEM-level privileges.

Microsoft’s RoguePlanet fix may be incomplete

ShieldBreak specifically bypasses Microsoft’s July mitigation for CVE-2026-50656.

Nightmare Eclipse claims Microsoft fixed one exploitation method without completely resolving the underlying security problem. That could leave systems vulnerable even after administrators installed the July Defender update.

Microsoft had not responded to the ShieldBreak disclosure at the time of publication. Given the severity of the privilege escalation, Microsoft will likely address the issue in a future security update.

The disclosure comes shortly after Microsoft patched around 400 vulnerabilities during August 2026 Patch Tuesday. The company also recently exposed DeadLock ransomware and its blockchain-powered infrastructure.

Via BleepingComputer