A security researcher has released a proof-of-concept exploit for a new Microsoft zero-day called ShieldBreak. The vulnerability demonstrates a full patch bypass for CVE-2026-50656, a Defender flaw known as RoguePlanet.
The researcher, who goes by Chaotic Eclipse (also known as INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse), claims that "Microsoft has failed to properly patch the RoguePlanet vulnerability."
Let me break down the ShieldBreak Microsoft Defender zero-day and what it means for Windows security.
Key Points About ShieldBreak
- ShieldBreak is a patch bypass for CVE-2026-50656 (RoguePlanet)
- The original vulnerability was a race condition in Microsoft Defender
- Successful exploitation grants SYSTEM-level privileges
- The PoC has a claimed 100% success rate
- It works on Windows 11 25H2 and Windows Server 2025
- Windows 10 is also vulnerable but not currently supported by the PoC
What Is RoguePlanet?
RoguePlanet, tracked as CVE-2026-50656, is a privilege escalation vulnerability in the Microsoft Malware Protection Engine (mpengine.dll). It was first disclosed by Chaotic Eclipse in June 2026.
The vulnerability is described as a race condition. Exploitation of vulnerability could provide an attacker with the capability to execute a shell with SYSTEM-level privileges. This enables them to run arbitrary code or perform unauthorized actions on the affected system.
Microsoft patched RoguePlanet almost a month after its disclosure. The company described it as a privilege escalation issue in the Microsoft Malware Protection Engine.
How ShieldBreak Works
The ShieldBreak Microsoft Defender zero-day exploits the same underlying vulnerability as RoguePlanet. Chaotic Eclipse claims that Microsoft's "defense-in-depth updates" failed to fully address the issue.
Based on the findings of the researcher, the patches made by Microsoft can result in leaking 8 bytes of information from Defender if it tries to open a file. This leak occurs on Windows 11 25H2 and Windows Server 2025.
The ShieldBreak PoC leverages this leak to achieve the same SYSTEM-level privilege escalation as the original RoguePlanet exploit. The researcher claims the PoC has a 100% success rate on supported systems.
Affected Systems
The ShieldBreak Microsoft Defender zero-day affects:
- Windows 11 25H2 (including Canary channel)
- Windows Server 2025
- Windows 10 (and respective server editions) – vulnerable but not yet supported by the PoC
The researcher notes that Windows 10 is vulnerable to ShieldBreak but the current PoC does not support it.
The Researcher's History
Chaotic Eclipse has a history of discovering and disclosing Windows vulnerabilities. In addition to ShieldBreak, the researcher has been credited with discovering:
- CVE-2026-50656 (RoguePlanet) – The original Defender race condition
- CVE-2026-62832 (LegacyHive) – A Windows User Profile Service privilege escalation vulnerability
The researcher has had a contentious relationship with Microsoft, including disputes over bug bounty payments and removal of PoC repositories from GitHub and GitLab.
Other August 2026 Microsoft Vulnerabilities
The ShieldBreak Microsoft Defender zero-day disclosure comes amid a busy Patch Tuesday for Microsoft. The company shipped patches for 421 security flaws, including 236 flaws in Windows.
CVE-2026-68820 – Windows Ancillary Function Driver Zero-Day
This is an actively exploited zero-day in the Windows Ancillary Function Driver for WinSock. It grants SYSTEM privileges and has a CVSS score of 7.0.
Key points:
- Use-after-free vulnerability in afd.sys
- Exploited in the wild
- Grants SYSTEM privileges
- CISA added it to the Known Exploited Vulnerabilities catalog
- Federal agencies must apply the fixes by August 25, 2026.
CVE-2026-62832 – Windows User Profile Service Privilege Escalation
This vulnerability was disclosed by Chaotic Eclipse under the name LegacyHive. This allows for an authenticated attacker to load another user’s registry hive.
Key points:
- Improper link resolution before file access
- Allows access to another user's data
- Can lead to administrator privileges
- User interaction is not required
CVE-2026-72971 – Windows Container Isolation FS Filter Driver Tampering
This is a publicly disclosed tampering vulnerability in unionfs.sys. It carries a CVSS score of 5.5.
What Administrators Should Do
The ShieldBreak Microsoft Defender zero-day must be acted upon by security teams:
Immediate Actions:
- Check systems that have Windows 11 25H2 and Windows Server 2025 installed.
- Be wary of exploits for the ShieldBreak Proof of Concept (PoC).
- Make sure to install all of the Microsoft updates available for August 2026.
- Specifically look out for CVE-2026-68820 (exploited).
CISA Requirements:
- Federal agencies should implement CVE-2026-68820 patches by August 25, 2026
- Observe the provisions of Binding Operational Directive (BOD) 26-04
Monitoring:
- Watch for unusual SYSTEM-level process creation
- Monitor for Defender engine anomalies
- Review for unauthorized privilege escalation
What We Don't Know
Microsoft has not yet confirmed or denied the ShieldBreak Microsoft Defender zero-day. The company told The Hacker News it was investigating the report.
Key unknowns:
- Whether Microsoft will issue a new patch
- The extent of exploitation in the wild
- Whether ShieldBreak has been used in actual attacks
Wrapping It Up
The ShieldBreak Microsoft Defender zero-day demonstrates that the original RoguePlanet vulnerability was not fully patched. The PoC achieves SYSTEM-level privilege escalation on Windows 11 25H2 and Windows Server 2025.
Key points to remember:
- ShieldBreak bypasses CVE-2026-50656 patch
- Grants SYSTEM privileges
- PoC has 100% success rate
- Windows 10 is vulnerable but not yet supported
- Microsoft is investigating
Organizations should apply all August 2026 Microsoft security updates. Prioritize the actively exploited CVE-2026-68820. Look out for signs of exploitation.
The ShieldBreak Microsoft Defender zero-day is another reminder that patch bypasses can occur. Timely patching and monitoring are essential.
FAQ Section
What is ShieldBreak?
ShieldBreak is a proof-of-concept exploit for a Microsoft Defender zero-day. It proves a complete patch bypass for CVE-2026-50656 (RoguePlanet), which results in SYSTEM privilege escalation.
Which systems are affected?
Windows 11 25H2 (including Canary channel) and Windows Server 2025 are supported. Windows 10 is also vulnerable but the current PoC does not support it.
What was RoguePlanet?
CVE-2026-50656 is a race condition in Microsoft Defender which exploits SYSTEM privilege escalation vulnerability. However, Microsoft has released the patch in July 2026 for the same, but ShieldBreak bypass that patch.
Who discovered ShieldBreak?
The security researcher Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) released the PoC. The researcher also discovered RoguePlanet and CVE-2026-62832 (LegacyHive).
What else got patched in August 2026?
Microsoft patched 421 CVEs, one of which was an actively exploited zero-day vulnerability in Windows Ancillary Function Driver for WinSock (CVE-2026-68820). This has been added to CISA’s KEV list.
