Story · 1 source · 1 articlefirst Sep 9, 07:30 UTCupdated Sep 9, 07:30 UTC (7d ago)

Microsoft Defender 'ShieldCrash' zero-day bypasses CVE-2026-69414 patch for SYSTEM-level file reads on fully patched Windows

highExploit / PoCimportance 72CVE-2026-69414 CVE-2026-50656

Merged summary · glm-5.3-flash · rewritten as coverage arrives

A researcher publishing as Nightmare Eclipse (also known as Chaotic Eclipse and MSNightmare) released 'ShieldCrash', an unpatched Microsoft Defender/Malware Protection Engine proof-of-concept that reads arbitrary files with SYSTEM privileges on fully patched…

Immediately after Microsoft's September 2026 Patch Tuesday, a researcher variously identified as Nightmare Eclipse, Chaotic Eclipse, or MSNightmare published ShieldCrash, described as their 11th Microsoft zero-day. The proof of concept targets Microsoft Defender's Microsoft Malware Protection Engine and performs arbitrary file reads with SYSTEM privileges. BleepingComputer initially characterized the flaw as granting SYSTEM-level access, but later reports from GBHackers, Cyber Security News, The Register, and SecurityWeek describe it more narrowly as arbitrary file read as SYSTEM — no arbitrary writes, full SYSTEM shell, or code execution. SecurityWeek notes the read capability can be used to drop the SAM database. ShieldCrash works on Windows 10, Windows 11, and Windows Server systems that applied the September 2026 security updates, including Malware Protection Engine version 1.1.26080.3, which contained the fix for CVE-2026-69414 (ShieldBreak), a high-severity elevation-of-privilege flaw. That ShieldBreak patch itself had bypassed the fix for the RoguePlanet race condition (CVE-2026-50656), making ShieldCrash the third bypass in the series and suggesting Microsoft's patching of the underlying attack path is incomplete. The PoC repository contains C++ project files, a Warden.dll library, and an EICAR test archive. SYSTEM-level file disclosure could expose credentials, application secrets, configuration files, private keys, and registry hives for post-compromise reconnaissance. As of the latest reports (September 9–10, 2026), no in-the-wild exploitation is confirmed, Microsoft has not confirmed the bypass and has not responded on a patch timeline. The researcher also recently released zero-day PoCs against CrowdStrike Falcon (FalconFlank), Kaspersky Endpoint Security (HardBreacher, patched), Gen Digital's Avast (PrettyPrague, possibly extending to AVG and Norton), and Nvidia; Kevin Beaumont confirmed several of these, including FalconFlank and HardBreacher, work as described. Advised mitigations include keeping Defender engine updates and tamper protection enabled, restricting admin access, monitoring Defender-related process behavior, and watching for unsigned DLLs touching Defender paths; CrowdStrike separately advises Falcon customers to disable the Microsoft Office File Suspicious Macro Removal policy while investigating FalconFlank.

ShieldCrash is an unpatched Microsoft Defender / Microsoft Malware Protection Engine flaw enabling arbitrary file reads with SYSTEM privileges; it can dump the SAM database but does not allow arbitrary writes, a full SYSTEM shell, or code…
ShieldCrash bypasses the September 2026 fix for CVE-2026-69414 (ShieldBreak), a high-severity elevation-of-privilege flaw in the Microsoft Malware Protection Engine, which was patched in engine version 1.1.26080.3; that patch itself…
No CVE identifier has been assigned to the new ShieldCrash flaw, and no confirmed in-the-wild exploitation has been reported as of September 9–10, 2026.
The PoC reportedly works on all supported Windows versions, specifically Windows 10, Windows 11, and Windows Server systems running the September 2026 security updates and Malware Protection Engine version 1.1.26080.3.
The release came immediately after Microsoft's September 2026 Patch Tuesday; SecurityWeek describes the ShieldBreak fixes as released September 3.
The researcher is identified by multiple aliases — Nightmare Eclipse, Chaotic Eclipse, and MSNightmare — and ShieldCrash is described as their 11th Microsoft zero-day.
Microsoft has not confirmed the bypass, has not issued a specific patch or mitigation, and has not responded on a patch timeline despite being contacted for comment.
The PoC repository contains C++ project files, a Warden.dll library, and an EICAR test archive, suggesting interaction with Defender's malware-detection and file-handling workflow.

VendorsCrowdStrike Kaspersky Gen Digital Avast Microsoft NVIDIA

ProductsCrowdStrike Falcon CrowdStrike Falcon Sensor Kaspersky Endpoint Security Avast Antivirus Windows 11 Windows Server 2025 Microsoft Defender Microsoft Malware Protection Engine Windows Windows 10 Windows Server

OrganizationsCrowdStrike Chaotic Eclipse Microsoft SOCRadar The Register MSNightmare

CountriesUnited States

Coverage timelineoldest first · each row is one article

Sep 9, 07:30 UTC · 7d ago
BleepingComputer· 60
New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access
Researcher Nightmare Eclipse released 'ShieldCrash', a zero-day exploit for Microsoft Defender that grants attackers SYSTEM-level access.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-50656	Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ". Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ". NVD description · AI analysis pending	7.0	11%	PoC	microsoft malware protection engine	—	Jun 16, 2026
CVE-2026-69414	Local Elevation of Privilege in Microsoft Defender Malware Protection Engine CVE-2026-69414, publicly dubbed 'ShieldBreak', is a high-severity (CVSS 3.1: 7.8) elevation-of-privilege flaw in the Microsoft Malware Protection Engine (MMPE) that powers Microsoft Defender, rooted in improper access control and improper privilege management (CWE-284/CWE-269). It is triggered locally: an attacker who already holds low privileges on the machine needs no user interaction (AV:L/AC:L/PR:L/UI:N) to trip the engine's flawed access checks, and successful exploitation yields high impact to confidentiality, integrity, and availability. News coverage reports public PoCs released under the 'ShieldBreak'/'ShieldCrash' names demonstrating SYSTEM-level access on Defender-protected Windows systems, including claims that the shipped patch can be bypassed and arbitrary files read as SYSTEM. Because MMPE ships as the scan engine inside Microsoft Defender, effectively every Defender-protected Windows 10/11 endpoint and server is potentially affected, though the source data specifies no affected engine version ranges. There is no confirmed in-the-wild exploitation (EPSS 0.6%, absent from CISA KEV), but given the public PoC claims, defenders should assume working exploit code exists. Do: Ensure Microsoft Defender and its Malware Protection Engine are fully up to date by installing the latest antimalware platform and security intelligence (definition) updates via Windows Update, WSUS/SCCM/Intune, or Defender for Endpoint, and verify the installed engine version against Microsoft's advisory since PoC reports claim the initial patch can be bypassed. Given the local, low-privilege attack path, prioritize hosts where untrusted users or code run locally, such as shared servers, RDS/terminal hosts, and developer workstations. Monitor Microsoft and researcher channels for follow-up engine updates or revised guidance addressing the reported patch bypass.	7.8	<1%		Microsoft Malware Protection Engine (used in Microsoft Defender)	masshundreds of millions of Windows endpoints (MMPE is bundled with Microsoft Defender, the default antimalware on modern Windows)	Aug 14, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-50656

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".

NVD description · AI analysis pending

7.0

11%

PoC

microsoft malware protection engine

—

Jun 16, 2026

CVE-2026-69414

Local Elevation of Privilege in Microsoft Defender Malware Protection Engine

CVE-2026-69414, publicly dubbed 'ShieldBreak', is a high-severity (CVSS 3.1: 7.8) elevation-of-privilege flaw in the Microsoft Malware Protection Engine (MMPE) that powers Microsoft Defender, rooted in improper access control and improper privilege management (CWE-284/CWE-269). It is triggered locally: an attacker who already holds low privileges on the machine needs no user interaction (AV:L/AC:L/PR:L/UI:N) to trip the engine's flawed access checks, and successful exploitation yields high impact to confidentiality, integrity, and availability. News coverage reports public PoCs released under the 'ShieldBreak'/'ShieldCrash' names demonstrating SYSTEM-level access on Defender-protected Windows systems, including claims that the shipped patch can be bypassed and arbitrary files read as SYSTEM. Because MMPE ships as the scan engine inside Microsoft Defender, effectively every Defender-protected Windows 10/11 endpoint and server is potentially affected, though the source data specifies no affected engine version ranges. There is no confirmed in-the-wild exploitation (EPSS 0.6%, absent from CISA KEV), but given the public PoC claims, defenders should assume working exploit code exists.

Do: Ensure Microsoft Defender and its Malware Protection Engine are fully up to date by installing the latest antimalware platform and security intelligence (definition) updates via Windows Update, WSUS/SCCM/Intune, or Defender for Endpoint, and verify the installed engine version against Microsoft's advisory since PoC reports claim the initial patch can be bypassed. Given the local, low-privilege attack path, prioritize hosts where untrusted users or code run locally, such as shared servers, RDS/terminal hosts, and developer workstations. Monitor Microsoft and researcher channels for follow-up engine updates or revised guidance addressing the reported patch bypass.

7.8

<1%

Microsoft Malware Protection Engine (used in Microsoft Defender)

masshundreds of millions of Windows endpoints (MMPE is bundled with Microsoft Defender, the default antimalware on modern Windows)

Aug 14, 2026