ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access
Researcher Chaotic Eclipse released ShieldBreak PoC, a claimed patch bypass for Microsoft Defender flaw CVE-2026-50656, now tracked as CVE-2026-69414.
Researcher Chaotic Eclipse released a PoC for ShieldBreak, a claimed full patch bypass of Microsoft Defender flaw CVE-2026-50656 (RoguePlanet), which can yield SYSTEM privileges. Independent researchers Kevin Beaumont and Will Dormann validated the exploit on Windows 11 25H2 and Windows Server 2025, noting it requires Defender to be enabled. Microsoft assigned CVE-2026-69414 (CVSS 7.8) with an 'Exploitation More Likely' assessment and is investigating, but has not yet released a patch. The article also notes CISA's KEV addition of the actively exploited Windows AFD.sys flaw CVE-2026-68820.
- ShieldBreak is assessed as a full patch bypass of CVE-2026-50656 (RoguePlanet), granting SYSTEM privileges via Defender.
- Microsoft assigned CVE-2026-69414 (CVSS 7.8) with an 'Exploitation More Likely' rating; no patch is available yet.
- Beaumont and Dormann independently validated the PoC on Windows 11 25H2 and Windows Server 2025.
- CISA added actively exploited Windows AFD.sys flaw CVE-2026-68820 to KEV with an August 25 federal patch deadline.
- ATT&CK
- T1068 Exploitation for Privilege EscalationT1574.001 DLL Search Order HijackingT1053.005 Scheduled Task
- Organizations
- Chaotic EclipseKevin BeaumontWill Dormann
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50656 | Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet " | 7.0 | 11% | PoC | |
| CVE-2026-62832 | Local Privilege Escalation via Link Following in Windows User Profile Service | 7.8 | 3% | ||
| CVE-2026-68820 | Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver | 7.0 | <1% | KEV | KEV |
| CVE-2026-69414 | Local Elevation of Privilege in Microsoft Defender Malware Protection Engine | 7.8 | 1% | PoC | |
| CVE-2026-72971 | Local Tampering via Link-Following Flaw in Windows 11 26H1 Container Isolation Driver | 5.5 | <1% |
From the original article
4 min read at thehackernews.com
The security researcher going by the name Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has released a proof-of-concept (PoC) for a new Microsoft zero-day called ShieldBreak . The vulnerability, rooted in Microsoft Defender for Windows, demonstrates a patch bypass for CVE-2026-50656 (CVSS score: 7. 8), otherwise known as RoguePlanet .
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.