ShieldBreak, the New Zero-Day Exploit That Elevates Windows Users to SYSTEM

PoC Targets Microsoft Defender

Security researcher Nightmare Eclipse, also known as Chaotic Eclipse, published ShieldBreak during the August 2026 Patch Tuesday. The PoC abuses Microsoft Defender to allow an unprivileged user to execute code with SYSTEM privileges.

The impact primarily affects recent versions of Windows 11 and Windows Server 2025. Windows 10 may also be affected, but no specific versions or definitive list of vulnerable builds have been provided.

The vulnerability is a local privilege escalation. An attacker must already have an account on the system, but can then obtain the highest level of control over the device.

The Technical Chain Relies on CFAPI and User-Mode Callbacks

ShieldBreak abuses how Defender analyzes files submitted for cloud hydration through the Cloud Filter API (CFAPI). The technique combines several Windows components:

1. a temporary directory is created and registered as a cloud synchronization provider;
2. an EICAR file is placed in the directory;
3. the path analyzed by Defender is redirected to System32;
4. CLFS replaces identity and hydration data files with phoneinfo.dll;
5. the QueueReporting scheduled task is triggered;
6. wer.dll loads phoneinfo.dll, which contains the attacker’s code;
7. the payload launches conhost.exe with SYSTEM privileges.

The key element is the user-mode callback executed during the scan. This allows the files used in the attack chain to be modified while Defender is processing them.

The Relationship with RoguePlanet Remains Disputed

Nightmare Eclipse presents ShieldBreak as a bypass of RoguePlanet, the vulnerability identified as CVE-2026-50656. However, this classification is not universally accepted.

Will Dormann of Tharros Labs and Kevin Beaumont consider the two exploits technically distinct. RoguePlanet is described as a race condition in Defender that uses virtual disks and native NT manipulation to cause the quarantine process to overwrite system files.

ShieldBreak follows a different path, relying on user-mode callbacks and modifying file contents during cloud scanning. Dormann also notes that the new PoC appears to require Microsoft Defender to be active, whereas RoguePlanet did not have the same requirement.

RoguePlanet was published on June 9. Microsoft acknowledged exploitation on June 16 and released fixes on July 9. These updates have not been identified as a mitigation for ShieldBreak.

What Administrators Should Do

No specific Microsoft patch for ShieldBreak has been identified. Available updates should still be applied, including the fixes addressing RoguePlanet.

The following activity should be monitored:

• unusual creation or modification of Cloud Sync providers;
• abnormal access to System32;
• unexpected presence of phoneinfo.dll;
• suspicious CLFS operations;
• unusual execution of the QueueReporting task;
• execution of conhost.exe with SYSTEM privileges.

Kevin Beaumont has published dedicated queries for detecting ShieldBreak, which can be integrated into SIEM systems or EDR tools.

No CVSS score, active exploitation campaigns, or real-world compromises attributed to the PoC have been reported. The requirement for Defender to be active may assist behavioral analysis, but it is not a recommendation to disable antimalware protection.