A security researcher named Nightmare Eclipse has discovered a new zero-day exploit for Microsoft Defender called “Shield break“after Microsoft released the August 2026 Patch Tuesday security updates.
The new vulnerability is described as a workaround for RoguePlanet, another Defender privilege escalation vulnerability that was disclosed in June and fixed by Microsoft a month later.
However, like cybersecurity expert Kevin Beaumont explainedthe two exploits work very differently. “RoguePlanet was a file system race condition vulnerability that used virtual disks and NT native file manipulation to cause the quarantine process to overwrite system files,” says Beaumont noted. “ShieldBreak user mode callback hook for changing file contents during a Defender Cloud Hydration scan via cfapi (Cloud Filter API).”
According to Nightmare Eclipse, ShieldBreak can be used to gain SYSTEM privileges on fully patched Windows 10, Windows 11 and Windows Server systems.
“Microsoft failed to properly patch the RoguePlanet vulnerability CVE-2026-50656. This PoC demonstrates a complete patch workaround.” they said.
“The PoC has been tested in the latest version of Windows 11 25h2 (+Canary Channel) and Windows Server 2025, the PoC also has a 100% success rate. Please note that Windows 10 (and corresponding server editions) are not currently supported, but they are also vulnerable to ShieldBreak.”
Will Dormann, senior vulnerability analyst at Tharros, confirmed on Tuesday that the exploit workedthat Microsoft Defender must be enabled for the ShieldBreak exploit in order to increase the attackers’ privileges.
The ShieldBreak exploit is part of an ongoing and heated dispute between Microsoft and Nightmare Eclipse over vulnerability disclosure and the company’s bug bounty practices.
Microsoft replied to the revelations of Nightmare Eclipse Warnings of legal action against people who “conduct malicious activities that cause real harm to their customers,” leading cybersecurity experts to believe the company was directly threatening the security researcher.
As of April 2026, the researcher has published LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma and Remove defense Zero-day exploits targeting Microsoft Defender, BitLocker, and various other Windows components
While Microsoft fixed the RoguePlanet vulnerability in July and the YellowKey, GreenPlasma and MiniPlasma vulnerabilities as part of Patch Tuesday in June 2026, the other vulnerabilities disclosed by Nightmare Eclipse are still awaiting an official patch.
BleepingComputer has contacted a Microsoft spokesperson regarding the new ShieldBreak Zero-Day and will update the story when we receive comment.
Overall prevention scores can hide what happens after the first access. Once attackers use valid credentials, prevention drops sharply.
The 2026 Blue Report measures defense technology for technology in 338 million simulations conducted in customer production environments.
