The security researcher known as Nightmare Eclipse has released another Microsoft Defender zero-day exploit, right after breaking Microsoft’s record September 2026 Patches.
called “ShieldCrash‘, the exploit targets fully patched Windows systems for privilege escalation.
The proof-of-concept (PoC) exploit demonstrates an arbitrary file read with system privileges, according to Nightmare Eclipse, also known as Chaotic Eclipse, Infinite Nightmare, and MSNightmare.
However, the core vulnerability could be used to gain full system privileges, allowing attackers to remove the SAM database, the researcher said.
Nightmare Eclipse also notes that the new zero-day is a bypass for ShieldBreak, the Microsoft Defender privilege escalation exploit dropped on Patch Tuesday in August 2026.
ShieldBreak was in turn released as a bypass for Microsoft’s patches against RoguePlanet, a race conditions bug that was dropped as Zero Day on Patch Tuesday in June 2026.
Microsoft patched RoguePlanet (CVE-2026-50656) on July 19. It acknowledged ShieldBreak on August 14th and released fixes for it on September 3rd. The error is tracked as CVE-2026-69414.
A nightmarish blackout says that Microsoft’s patches for ShieldBreak were incomplete and that the security flaw could still be exploited, releasing ShieldCrash as evidence.
Security Week emailed Microsoft for a statement on the new zero-day exploit and will update this article if the company responds.
According to SOCRadar CISO Ensar Seker, ShieldCrash is of concern mainly because it reveals a weakness in Microsoft’s patching of attack paths for the underlying vulnerability.
“When researchers can bypass successive fixes for RoguePlanet and ShieldBreak, it suggests that the underlying security boundary or attack surface may require a more comprehensive redesign rather than another narrowly targeted fix,” Seker said.
It advises security teams to monitor Microsoft guidance and Defender intelligence updates, enable tamper protection, limit administrator access and local execution paths, and look for suspicious process behavior related to Defender-related mechanisms.
“Microsoft should also evaluate the full class of vulnerability and associated code paths, not just the specific condition demonstrated by this latest proof of concept,” Secker added.
Related: Nightmare Eclipse removes CrowdStrike, Nvidia, Avast Zero-Day Exploits
Related: Microsoft patches recorded 974 vulnerabilities, including two exploited zero days
Related: September 2026 Android Updates Patch 180 Vulnerabilities
Related: Adobe has patched over 170 vulnerabilities, including Commerce Zero-Day
