Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed
Researcher Chaotic Eclipse released a PoC showing CVE-2026-69414's patch is bypassable, allowing arbitrary file reads as SYSTEM on current Windows.
The researcher known as Chaotic Eclipse published a proof-of-concept for a zero-day in Microsoft Defender, dubbed ShieldCrash, assessed as a patch bypass for ShieldBreak (CVE-2026-69414, CVSS 7.8). The PoC demonstrates an arbitrary file read as SYSTEM with the latest Windows installed, and all supported desktop versions are said to be impacted. Microsoft patched the original issue in Microsoft Malware Protection Engine 1.1.26080.3, which updates automatically. The same researcher recently released PoCs for flaws in CrowdStrike Falcon Sensor, Kaspersky, Avast Antivirus and NVIDIA.
- ShieldCrash is a patch bypass for ShieldBreak CVE-2026-69414 (CVSS 7.8)
- PoC demonstrates arbitrary file read as SYSTEM on fully updated Windows
- Original flaw patched in Malware Protection Engine 1.1.26080.3 without customer action
- Same researcher recently released PoCs for CrowdStrike, Kaspersky, Avast and NVIDIA flaws
- CVEs
- CVE-2026-69414
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-69414 | Local Elevation of Privilege in Microsoft Defender Malware Protection Engine | 7.8 | 1% | PoC |
From the original article
2 min read at thehackernews.com
The security researcher known as Chaotic Eclipse has dropped a proof-of-concept (PoC) for yet another zero-day in Microsoft Defender. The vulnerability, codenamed ShieldCrash, is assessed to be a patch bypass for CVE-2026-69414 (CVSS score: 7. 8), also called ShieldBreak, which the researcher reported last month.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.