ShieldBreak: PoC Bypasses Microsoft Defender Patch and Targets SYSTEM Privileges

Bypassing the RoguePlanet Fix

Researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse, has published a proof of concept for ShieldBreak.

According to the researcher, ShieldBreak completely bypasses Microsoft’s fix for CVE-2026-50656, dubbed RoguePlanet. The original vulnerability was disclosed in June 2026, and Microsoft released a patch nearly a month later.

RoguePlanet affects the Microsoft Malware Protection Engine, specifically the mpengine.dll component. Microsoft classified it as a privilege escalation vulnerability with a CVSS score of 7.8.

Exploiting the flaw can allow an attacker to open a shell with SYSTEM privileges, execute arbitrary code, and perform unauthorized actions. According to Chaotic Eclipse, ShieldBreak retains this impact even after the update is installed.

Microsoft said it is investigating the report concerning data loss. No specific confirmation of the ShieldBreak bypass has been reported.

Tested Systems and Potential Exposure

The PoC was tested on the latest versions of:

• Windows 11 25H2, including the Canary Channel;
• Windows Server 2025.

The researcher claims a 100% success rate in these environments.

The PoC does not support Windows 10 or its server editions. However, Chaotic Eclipse also considers these systems vulnerable to ShieldBreak. The actual exposure of individual versions has not been clarified further.

The security updates associated with CVE-2026-50656 may also cause an 8-byte data loss when Defender attempts to open a file under certain conditions on Windows 11 25H2 and Windows Server 2025.

Other Vulnerabilities Addressed in Microsoft’s Updates

Microsoft’s update package includes fixes for 421 vulnerabilities, including 236 in Windows. Those listed include:

• CVE-2026-62832, dubbed LegacyHive, with a CVSS score of 7.8. An authenticated attacker using another local account’s credentials can load the user’s registry hive, access or modify their data, and obtain administrative privileges without user interaction.
• CVE-2026-68820, with a CVSS score of 7.0, an actively exploited zero-day in the Windows Ancillary Function Driver for WinSock. Exploitation can lead to SYSTEM privileges.
• CVE-2026-72971, with a CVSS score of 5.5, a publicly disclosed tampering vulnerability in unionfs.sys, part of the Windows Container Isolation FS Filter Driver.

What Administrators Should Do

Administrators should apply all available Microsoft updates, including those addressing CVE-2026-50656, CVE-2026-62832, CVE-2026-68820, and CVE-2026-72971.

Priority should be given to CVE-2026-68820, which CISA has already added to its Known Exploited Vulnerabilities (KEV) catalog. U.S. federal agencies must install the fix by August 25, 2026.

No specific mitigation or additional patch beyond Microsoft’s already released updates has been provided for ShieldBreak. Administrators should therefore monitor vendor advisories and investigate any anomalous executions with SYSTEM privileges on affected Defender systems.