ShieldBreak: PoC Bypasses Patch for Microsoft Defender Vulnerability

A security researcher known under several handles — Chaotic Eclipse, INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse — has publicly released a proof-of-concept for a new Microsoft vulnerability dubbed ShieldBreak. The problem is rooted in Microsoft Defender for Windows and amounts to a patch bypass for CVE-2026-50656 (CVSS score 7.8), previously known as RoguePlanet.

RoguePlanet is described as a race condition: on successful exploitation, an attacker can spawn a shell with SYSTEM-level privileges and execute arbitrary code or perform unauthorized actions. The flaw was first reported back in June 2026, but Microsoft released a fix almost a month later, characterizing it as an elevation-of-privilege issue in the malware protection engine (mpengine.dll).

Soon afterward, the same researcher claimed that the “defense-in-depth updates” Microsoft added to address CVE-2026-50656 cause Defender, in certain scenarios, to disclose 8 bytes of data when it attempts to open a file — on Windows 11 25H2 and Windows Server 2025. At the time, Microsoft told The Hacker News that it was aware of the report and was investigating.

ShieldBreak, in the author's assessment, is a full-fledged patch bypass: “Microsoft failed to properly close the RoguePlanet vulnerability.” According to him, the PoC has been tested on the current version of Windows 11 25H2 (including the Canary channel) and Windows Server 2025, and boasts a “100% success rate.” Windows 10 and the corresponding server editions are not formally supported by the PoC, but, the researcher claims, are vulnerable as well. The Hacker News has reached out to Microsoft and promises to update the article once a response is received.

The news comes against the backdrop of Microsoft's August update batch, which closed 421 vulnerabilities, 236 of them affecting Windows. Among them is CVE-2026-62832 (CVSS 7.8), an elevation-of-privilege flaw in the Windows User Profile Service, disclosed by the same Chaotic Eclipse under the name LegacyHive: an authenticated attacker, holding the credentials of another local account, can load someone else's registry hive and obtain administrator rights without any action from the victim.

Also fixed were an actively exploited zero-day in the WinSock auxiliary function driver (CVE-2026-68820, CVSS 7.0), which grants SYSTEM privileges, and a publicly disclosed issue in the Windows Container Isolation filter driver unionfs.sys (CVE-2026-72971, CVSS 5.5). The U.S. agency CISA added CVE-2026-68820 to its catalog of known exploited vulnerabilities, requiring federal agencies to install the fixes by August 25, 2026.

Source: The Hacker News