On Friday, Microsoft confirmed it has begun working on a security patch for a Defender zero-day vulnerability named "ShieldBreak." A security researcher who uses the "Nightmare Eclipse" handle disclosed this privilege escalation vulnerability after Microsoft released the August 2026 Patch Tuesday security updates. "Microsoft is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims," a Microsoft spokesperson told BleepingComputer when asked for a statement regarding the new ShieldBreak zero-day. "Microsoft is committed to investigating security issues and updating impacted products to protect customers as soon as possible." Nightmare Eclipse described ShieldBreak as a bypass for RoguePlanet, another Defender privilege escalation flaw disclosed in June, and shared a ShieldBreak proof-of-concept (PoC) exploit that local attackers with limited permissions can use to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. "Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass," Nightmare Eclipse said. "The PoC was tested in the latest version of windows 11 25h2 (+Canary channel) and windows server 2025, the PoC also have a 100% success rate. Please note that Windows 10 (and respective server editions) are not currently supported, they are however vulnerable to ShieldBreak as well." Vulnerability analyst ...
Microsoft working on Defender patch for ShieldBreak zero-day
Affected Software
Frequently Asked Questions
What has Microsoft confirmed about ShieldBreak?
Microsoft said it is aware of the reported ShieldBreak vulnerability and is actively investigating the validity and potential applicability of the claims. It also confirmed it has begun working on a security patch.
Which systems and attackers are described as affected?
The disclosed proof-of-concept is described as allowing local attackers with limited permissions to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. Microsoft Defender is also identified among the affected software.
Is ShieldBreak confirmed to be a bypass of the earlier RoguePlanet fix?
Nightmare Eclipse described ShieldBreak as a full patch bypass for RoguePlanet, a Defender privilege-escalation vulnerability disclosed in June and identified as CVE-2026-50656. This characterization comes from the researcher; Microsoft said it is still investigating the claims.