New ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender
Researcher Nightmare Eclipse released ShieldCrash, a Microsoft Defender zero-day PoC bypassing ShieldBreak patches to gain System privileges on Windows.
The researcher known as Nightmare Eclipse released a PoC zero-day exploit dubbed ShieldCrash against Microsoft Defender on fully patched Windows systems. The exploit grants arbitrary file read with System privileges and can be used to drop the SAM database. It bypasses Microsoft's September 3 fixes for ShieldBreak (CVE-2026-69414), which itself bypassed patches for the RoguePlanet race condition (CVE-2026-50656). Microsoft has been contacted for comment and has not yet responded.
- PoC demonstrates arbitrary file read with System privileges and can dump the SAM database
- ShieldCrash bypasses September fixes for ShieldBreak (CVE-2026-69414), which bypassed RoguePlanet (CVE-2026-50656) patches
- Third bypass in the series suggests Microsoft's patching of the underlying attack path is incomplete
- Experts advise enabling Defender tamper protection, restricting admin access, and monitoring Defender-related process behavior
- Vendors
- Microsoft
- Products
- Microsoft Defender
- Organizations
- SOCRadar
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50656 | Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet " | 7.0 | 11% | PoC | |
| CVE-2026-69414 | Local Elevation of Privilege in Microsoft Defender Malware Protection Engine | 7.8 | 1% | PoC |
From the original article
2 min read at securityweek.com
The exploit provides full System privileges on Windows machines running the September 2026 patches. The post New ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.