“ShieldCrash”: a new zero-day exploit for Microsoft Defender grants SYSTEM privileges

A security researcher known by the handle Nightmare Eclipse has released a new zero-day exploit for Microsoft Defender. The tool has been named ShieldCrash.

According to the available information, the vulnerability makes it possible to obtain SYSTEM-level privileges — the highest privilege level in Windows. Such access effectively means full control over the compromised machine.

What makes the situation especially piquant is the timing of the release: the exploit surfaced right after Microsoft rolled out its September batch of security updates as part of Patch Tuesday 2026. In other words, the flaw turned out not to be closed by the fixes that had just shipped.

Details about the mechanics of the vulnerability and the conditions under which it triggers cannot yet be gleaned from the available material. It is also unknown whether Microsoft has responded to the disclosure. As official clarifications emerge, the picture will likely become clearer.

Source: Bleeping Computer