A security researcher known as Nightmare Eclipse has published a proof-of-concept exploit for a new Microsoft Defender vulnerability dubbed ShieldBreak. The researcher claims it fully bypasses the patch Microsoft issued last month for the RoguePlanet privilege-escalation flaw, tracked as CVE-2026-50656.

The exploit was released on August 12, one day after Microsoft's August Patch Tuesday updates. It targets fully patched Windows 10, Windows 11 (including the 25H2 release and Canary channel builds), and Windows Server 2025. Nightmare Eclipse asserts the PoC achieves a 100% success rate when Windows Defender is enabled — a prerequisite for the exploit to function.

Will Dormann, principal vulnerability analyst at Tharros, independently confirmed the exploit works. Kevin Beaumont, who published detection queries for Microsoft Defender for Endpoint, noted ShieldBreak operates differently from RoguePlanet. RoguePlanet was a filesystem race condition using virtual disks and NT native file manipulation. ShieldBreak instead leverages a user-mode callback hook to modify file contents during a Defender cloud-hydration scan via the Cloud Filter API (cfapi).

What's new

  • Vulnerability name: ShieldBreak
  • Type: Microsoft Defender privilege escalation / patch bypass
  • Related CVE: CVE-2026-50656 (RoguePlanet, patched July 2026)
  • Affected versions: Windows 10, Windows 11 25H2 (and Canary), Windows Server 2025
  • Prerequisite: Windows Defender must be enabled
  • Impact: Local attacker gains SYSTEM privileges
  • Disclosure date: August 12, 2026
  • Researcher: Nightmare Eclipse

ShieldBreak is the latest in a series of zero-day disclosures from Nightmare Eclipse since April 2026. The list includes LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend — targeting Defender, BitLocker, and other Windows components. Microsoft patched RoguePlanet in July and addressed YellowKey, GreenPlasma, and MiniPlasma in June's Patch Tuesday. Several of the researcher's other disclosed flaws remain unpatched.

The exploit is delivered as a Windows application that requires the user to run it. Nightmare Eclipse said the new bug builds on the earlier RoguePlanet exploit. Microsoft has not yet released a patch for ShieldBreak. A Microsoft spokesperson did not immediately comment.

Why it matters

The disclosure escalates a public dispute between Microsoft and Nightmare Eclipse over vulnerability handling. In May, Microsoft published a blog post threatening legal action against researchers who disclose zero-days outside its coordinated vulnerability disclosure program. The post drew sharp criticism from the security community, many of whom described similar experiences with Microsoft's bug-report handling. Microsoft later walked back the rhetoric on social media but left the original post unchanged.

ShieldBreak arrives the day after Patch Tuesday, a timing choice that maximizes the exposure window before the next monthly cycle. For defenders, the exploit's reliance on Defender being enabled creates a paradox: the component meant to protect the system becomes the attack surface. Beaumont's detection queries for Defender for Endpoint offer a near-term mitigation path, but a vendor patch remains the only complete fix.

Our take

The back-and-forth illustrates a breakdown in coordinated disclosure that neither side appears willing to repair. Microsoft's legal threats damaged trust; the researcher's repeated zero-day drops have left customers exposed. Microsoft's next Patch Tuesday cycle may be the next opportunity for a fix, but the pattern suggests more unpatched flaws from this researcher are queued. Enterprises should treat Defender as a potential attack vector until Microsoft demonstrates it can close the bypass class, not just individual instances.

Sources