ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access
Researcher Chaotic Eclipse released ShieldBreak PoC, a claimed patch bypass for Microsoft Defender flaw CVE-2026-50656, now tracked as CVE-2026-69414.
Researcher Chaotic Eclipse released a PoC for ShieldBreak, a claimed full patch bypass of Microsoft Defender flaw CVE-2026-50656 (RoguePlanet), which can yield SYSTEM privileges. Independent researchers Kevin Beaumont and Will Dormann validated the exploit on Windows 11 25H2 and Windows Server 2025, noting it requires Defender to be enabled. Microsoft assigned CVE-2026-69414 (CVSS 7.8) with an 'Exploitation More Likely' assessment and is investigating, but has not yet released a patch. The article also notes CISA's KEV addition of the actively exploited Windows AFD.sys flaw CVE-2026-68820.
62