60
57
35
47
60
30
57
57
ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch
Researcher Chaotic Eclipse published a PoC bypassing Microsoft's CVE-2026-50656 Defender patch, enabling SYSTEM-level code execution on fully patched Windows systems.
Security researcher Chaotic Eclipse released a proof-of-concept for ShieldBreak, a Microsoft Defender zero-day that fully bypasses the patch for CVE-2026-50656 (RoguePlanet), a race condition in the Malware Protection Engine (mpengine.dll) allowing SYSTEM-level code execution. The PoC was tested on Windows 11 25H2 and Windows Server 2025 with a 100% success rate, and Windows 10 is also vulnerable though not supported by the PoC; the flaw may also leak 8 bytes of memory. Microsoft's MSRC had criticized the researcher's repeated uncoordinated disclosures, including YellowKey (BitLocker bypass), GreenPlasma, and LegacyHive (User Profile Service LPE).
58
55
30
60
30
57
57
57
57
30
57
57
57
57
60
30
57
60
60
57
30
January 2021 Patch Tuesday: Microsoft plugs Defender zero-day RCE
60
57
30
60
30
30
60
57
Microsoft Warns of Two Actively Exploited Defender Vulnerabilities
60
55
42