Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed
Researcher Chaotic Eclipse released a PoC showing CVE-2026-69414's patch is bypassable, allowing arbitrary file reads as SYSTEM on current Windows.
The researcher known as Chaotic Eclipse published a proof-of-concept for a zero-day in Microsoft Defender, dubbed ShieldCrash, assessed as a patch bypass for ShieldBreak (CVE-2026-69414, CVSS 7.8). The PoC demonstrates an arbitrary file read as SYSTEM with the latest Windows installed, and all supported desktop versions are said to be impacted. Microsoft patched the original issue in Microsoft Malware Protection Engine 1.1.26080.3, which updates automatically. The same researcher recently released PoCs for flaws in CrowdStrike Falcon Sensor, Kaspersky, Avast Antivirus and NVIDIA.
- ShieldCrash is a patch bypass for ShieldBreak CVE-2026-69414 (CVSS 7.8)
- PoC demonstrates arbitrary file read as SYSTEM on fully updated Windows
- Original flaw patched in Malware Protection Engine 1.1.26080.3 without customer action
- Same researcher recently released PoCs for CrowdStrike, Kaspersky, Avast and NVIDIA flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-69414 | Local Elevation of Privilege in Microsoft Defender Malware Protection Engine CVE-2026-69414, publicly dubbed 'ShieldBreak', is a high-severity (CVSS 3.1: 7.8) elevation-of-privilege flaw in the Microsoft Malware Protection Engine (MMPE) that powers Microsoft Defender, rooted in improper access control and improper privilege management (CWE-284/CWE-269). It is triggered locally: an attacker who already holds low privileges on the machine needs no user interaction (AV:L/AC:L/PR:L/UI:N) to trip the engine's flawed access checks, and successful exploitation yields high impact to confidentiality, integrity, and availability. News coverage reports public PoCs released under the 'ShieldBreak'/'ShieldCrash' names demonstrating SYSTEM-level access on Defender-protected Windows systems, including claims that the shipped patch can be bypassed and arbitrary files read as SYSTEM. Because MMPE ships as the scan engine inside Microsoft Defender, effectively every Defender-protected Windows 10/11 endpoint and server is potentially affected, though the source data specifies no affected engine version ranges. There is no confirmed in-the-wild exploitation (EPSS 0.6%, absent from CISA KEV), but given the public PoC claims, defenders should assume working exploit code exists. Do: Ensure Microsoft Defender and its Malware Protection Engine are fully up to date by installing the latest antimalware platform and security intelligence (definition) updates via Windows Update, WSUS/SCCM/Intune, or Defender for Endpoint, and verify the installed engine version against Microsoft's advisory since PoC reports claim the initial patch can be bypassed. Given the local, low-privilege attack path, prioritize hosts where untrusted users or code run locally, such as shared servers, RDS/terminal hosts, and developer workstations. Monitor Microsoft and researcher channels for follow-up engine updates or revised guidance addressing the reported patch bypass. | 7.8 | <1% |
| masshundreds of millions of Windows endpoints (MMPE is bundled with Microsoft Defender, the default antimalware on modern Windows) |
Full article346 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 09, 2026Vulnerability / Endpoint Security
The security researcher known as Chaotic Eclipse has dropped a proof-of-concept (PoC) for yet another zero-day in Microsoft Defender.
The vulnerability, codenamed ShieldCrash, is assessed to be a patch bypass for CVE-2026-69414 (CVSS score: 7.8), also called ShieldBreak, which the researcher reported last month.
"Microsoft has failed to properly patch ShieldBreak CVE-2026-69414," Chaotic Eclipse said. "Under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak. While Microsoft fixed several things to prevent re-exploiting the issue, they missed a spot where ShieldBreak can still be exploited."
The PoC demonstrates an arbitrary file read as SYSTEM with the latest version of Windows installed. All supported versions of the desktop operating system are said to be impacted.
The development comes days after Redmond shipped an update to the Microsoft Malware Protection Engine to plug CVE-2026-69414. The issue has been patched in Malware Protection Engine version 1.1.26080.3. It does not require any customer action and does not affect systems that have disabled Microsoft Defender.
"In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine," the tech giant said. "In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner."
"For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating."
In recent weeks, Chaotic Eclipse has also released PoC exploits for four vulnerabilities impacting CrowdStrike Falcon Sensor (FalconFlank), Kaspersky (HardBreacher), Avast Antivirus (PrettyPrague), and NVIDIA (GreenSection). Both HardBreacher and PrettyPrague have since been patched by the respective security vendors, while CrowdStrike told The Hacker News that it's investigating the report.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/09/researcher-drops-new-microsoft-defender.html