ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch
Researcher Chaotic Eclipse published a PoC bypassing Microsoft's CVE-2026-50656 Defender patch, enabling SYSTEM-level code execution on fully patched Windows systems.
Security researcher Chaotic Eclipse released a proof-of-concept for ShieldBreak, a Microsoft Defender zero-day that fully bypasses the patch for CVE-2026-50656 (RoguePlanet), a race condition in the Malware Protection Engine (mpengine.dll) allowing SYSTEM-level code execution. The PoC was tested on Windows 11 25H2 and Windows Server 2025 with a 100% success rate, and Windows 10 is also vulnerable though not supported by the PoC; the flaw may also leak 8 bytes of memory. Microsoft's MSRC had criticized the researcher's repeated uncoordinated disclosures, including YellowKey (BitLocker bypass), GreenPlasma, and LegacyHive (User Profile Service LPE).
- ShieldBreak bypasses the July patch for RoguePlanet CVE-2026-50656 (CVSS 7.8).
- PoC achieved 100% success on Windows 11 25H2 and Windows Server 2025; Windows 10 also vulnerable.
- Race condition in mpengine.dll enables SYSTEM-level code execution; 8-byte memory leak possible.
- Follows related disclosures: YellowKey, GreenPlasma, and LegacyHive (ProfSvc LPE).
- MSRC called the uncoordinated disclosures irresponsible and revoked the researcher's MSRC access.
- CVEs
- CVE-2026-50656
- Vendors
- Microsoft
- Organizations
- MicrosoftChaotic Eclipse
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50656 | Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet " | 7.0 | 11% | PoC |
From the original article
4 min read at securityaffairs.com
Chaotic Eclipse released a PoC for ShieldBreak, a Microsoft Defender zero-day that bypasses the CVE-2026-50656 patch and could enable SYSTEM-level code execution. Security researcher Chaotic Eclipse , also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a PoC for ShieldBreak, a Microsoft Defender zero-day.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.