ShieldBreak: A Windows Defender Zero‑Day Uncovered on Patch Tuesday (with PoC)

On August 11, 2026, after Microsoft patched 421 vulnerabilities, the threat group Nightmare Eclipse released ShieldBreak, a Windows Defender zero‑day that evades the official RoguePlanet (CVE‑2026‑50656) fix and provides local privilege escalation to SYSTEM with a reported 100% success rate.

Nightmare Eclipse has previously published nine Defender zero‑days (BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, RoguePlanet, GreatXML, LegacyHive). ShieldBreak is the tenth and remains unpatched.

Technical analysis : RoguePlanet exploits a file‑system TOCTOU race using virtual disks and NT native file operations to trick Defender’s isolation process. ShieldBreak, by contrast, hooks a user‑mode callback during Defender’s cloud‑defined update scan, leveraging the Cloud Filter API (cfapi) to modify file contents in‑flight. Both achieve the same end‑goal—SYSTEM privileges—but through entirely different attack surfaces.

Exploitation prerequisites :

The attacker already has a standard‑user account on the target machine.

Microsoft Defender must be enabled (real‑time protection status is irrelevant).

No administrator rights or physical access are required.

Affected scope :

Windows 11 25H2 (both release and Canary channels) – confirmed exploitable.

Windows Server 2025 – confirmed exploitable.

Windows 10 and other server versions – vulnerable, but the current PoC does not yet support them (researchers indicate a redesign could enable exploitation).

Validation : Two independent security researchers have publicly confirmed the exploit:

Kevin Beaumont (former Microsoft employee) – "I ran it on the latest Windows 11 and it worked."

Will Dormann (Tharros lead vulnerability analyst) – "Confirmed effective. Defender must be enabled for the exploit to work."

Both executed the PoC on fully patched systems without special configuration.

Microsoft response : A Microsoft spokesperson told BleepingComputer that the company is aware of the report, is actively investigating its impact, and will update affected products as soon as possible. No patch is currently available.

Detection and defense recommendations :

Detection signals (high confidence)

If MsMpEng.exe (the Defender engine) spawns a process that runs at SYSTEM integrity and the child process is one of the following, the activity is likely the ShieldBreak exploit:

cmd.exe
powershell.exe
pwsh.exe
conhost.exe
cscript.exe / wscript.exe

KQL query (Microsoft Defender for Endpoint)

DeviceProcessEvents
| where InitiatingProcessFileName =~ "MsMpEng.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","conhost.exe","cscript.exe","wscript.exe")
| where ProcessIntegrityLevel == "System"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessParentFileName
| order by Timestamp desc

Sigma rule (Sysmon / MDE)

title: SYSTEM Shell Spawned From Microsoft Defender Engine (ShieldBreak)
status: experimental
selection:
  ParentImage|endswith: '\MsMpEng.exe'
  Image|endswith:
    - '\cmd.exe'
    - '\powershell.exe'
    - '\pwsh.exe'
    - '\conhost.exe'
condition: selection
level: high

Secondary indicators include abnormal write operations via the Cloud Filter API, unexpected DLL loads in the MsMpEng.exe process tree, and rapid creation of reparse points in user‑writable directories.

Mitigation suggestions

Enforce application whitelisting (WDAC or AppLocker in enforce mode) to block unauthorized binaries even if privilege escalation succeeds.

Deploy third‑party EDR solutions to provide a defense layer during the window where Defender is ineffective.

Apply the principle of least privilege to limit the capabilities of standard‑user accounts.

Monitor Microsoft advisories for updates to the engine component linked to CVE‑2026‑50656 and apply patches promptly.

In summary, ShieldBreak demonstrates that fixing one vulnerability can open another attack surface; the exploit works even when Defender is enabled, offers a guaranteed SYSTEM shell, and forces defenders to rely on detection, hardening, and timely patching rather than assuming the patch eliminates the risk.