ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access

Security researcher Chaotic Eclipse (also known as INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has released a proof-of-concept (PoC) for a new Microsoft zero-day called ShieldBreak. The vulnerability is a patch bypass for CVE-2026-50656 (CVSS 7.8), also known as RoguePlanet, a race condition in Microsoft Defender for Windows that could allow an attacker to spawn a shell with SYSTEM-level privileges.

Microsoft initially patched RoguePlanet in July 2026, describing it as a privilege escalation issue in the Microsoft Malware Protection Engine (mpengine.dll). However, Chaotic Eclipse claims the patch is incomplete and that the defense-in-depth updates can cause Defender to leak 8 bytes of data when opening files on Windows 11 25H2 and Windows Server 2025. The researcher states the ShieldBreak PoC has a 100% success rate on the latest versions of Windows 11 25H2 (including Canary channel) and Windows Server 2025, and that Windows 10 and corresponding server editions are also vulnerable but not currently supported.

The disclosure coincides with Microsoft’s August 2026 Patch Tuesday, which addressed 421 security flaws, including 236 in Windows. Notable patches include CVE-2026-62832 (CVSS 7.8), a Windows User Profile Service privilege escalation vulnerability disclosed by Chaotic Eclipse as LegacyHive, and CVE-2026-68820 (CVSS 7.0), an actively exploited zero-day in the Windows Ancillary Function Driver for WinSock that grants SYSTEM privileges. CISA has added CVE-2026-68820 to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to patch by August 25, 2026. Microsoft also fixed CVE-2026-72971 (CVSS 5.5), a Windows Container Isolation FS Filter Driver (unionfs.sys) tampering vulnerability.

The Hacker News has contacted Microsoft for comment and will update the story as more information becomes available.