Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEM
Unpatched Windows Defender zero-day 'ShieldCrash' PoC lets local attackers read arbitrary files as SYSTEM, apparently bypassing the CVE-2026-69414 patch.
Researcher MSNightmare published a skeleton proof-of-concept for 'ShieldCrash', an unpatched Microsoft Defender flaw enabling arbitrary file reads with SYSTEM privileges that reportedly persists on supported Windows versions after September 2026 updates. It appears to bypass the recent fix for the Malware Protection Engine elevation-of-privilege flaw CVE-2026-69414 (ShieldBreak), patched in engine version 1.1.26080.3. SYSTEM-level file disclosure could expose credentials, application secrets and registry hives and support post-compromise reconnaissance. No active exploitation is confirmed and Microsoft had issued no specific patch or mitigation at disclosure time.
- Skeleton PoC released by researcher MSNightmare; no assigned CVE yet.
- Claimed bypass of ShieldBreak fix CVE-2026-69414 in engine 1.1.26080.3.
- SYSTEM-level read exposes credentials, secrets and registry hives for recon.
- CrowdStrike says claims remain under review; no mitigation available yet.
- Defenders urged to keep engine updates enabled and apply defense-in-depth.
- CVEs
- CVE-2026-69414
- Vendors
- MicrosoftCrowdStrike
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-69414 | Local Elevation of Privilege in Microsoft Defender Malware Protection Engine | 7.8 | 1% | PoC |
From the original article
2 min read at gbhackers.com
A newly published proof-of-concept (PoC) called ShieldCrash reveals an unpatched vulnerability in Microsoft Defender that allows a local attacker to gain arbitrary file-read access in the SYSTEM context.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.