A researcher went round Microsoft's fix in five weeks — ShieldBreak turns Defender itself into the route to SYSTEM

ShieldBreak is a local privilege escalation flaw in the Microsoft Malware Protection Engine — the scanning component behind Microsoft Defender. It has been assigned CVE-2026-69414.

An attacker who already has limited access to a machine can use it to become SYSTEM, the highest privilege level Windows has. The precondition is that Defender is enabled.

There is no patch.

The uncomfortable shape of it

Most privilege escalation bugs live in a component you could, in principle, remove. This one lives in the security product, and it only works when the security product is running.

That inverts the usual advice. The researcher's own note is that disabling Defender stops the attack — which is true, and is not a mitigation any defender can actually take.

What it bypasses

In June 2026 the same researcher disclosed RoguePlanet (CVE-2026-50656), a Defender privilege escalation that worked by racing the filesystem using virtual disks. It was unreliable: race conditions are timing-dependent, and it did not land consistently across machines.

Microsoft patched RoguePlanet on 8 July.

ShieldBreak went public on 12 August, three days after August's Patch Tuesday, and claims to be a full bypass of that fix.

How it works, per Kevin Beaumont

The mechanism is not a retread. Security researcher Kevin Beaumont describes it as a user-mode callback hook that changes a file's contents during a Defender cloud-hydration scan, through the Cloud Filter API (cfapi) — the Windows interface that backs on-demand file sync for things like OneDrive.

The short version: the file Defender inspects and the file Defender then acts on are not guaranteed to be the same file. ShieldBreak makes that gap deterministic. The researcher reports a 100% success rate on the systems tested, against RoguePlanet's flakiness.

That distinction matters for how you read it. This is not the same bug resurfacing because the patch was too narrow. It is a second route to the same outcome through a different Windows subsystem — which is the pattern N-able hit and, in a different form, the quoting bug Kemp shipped twice. A fix that closes one path is not the same as fixing the class.

What is affected

Microsoft's own assessment is the one that should set your priority: public disclosure has happened, proof-of-concept code exists, exploitation is considered more likely, and no fix is available. That combination is unusual, and it is a fair description of the current state.

Why it was published this way

ShieldBreak was released with no notice to Microsoft.

The researcher, who goes by Nightmare Eclipse, has been in an open dispute with Microsoft since April 2026 over how the company handles vulnerability reports and bug bounty awards, and has published a string of zero-days in Defender, BitLocker and other Windows components since. Reports differ on the count — BleepingComputer's tally is nine; other write-ups say eight. We have not been able to reconcile the two, so treat the exact number as unsettled.

It is worth holding two things at once here. Microsoft paid out $20 million to 562 researchers in the last programme year, which is not the behaviour of a company ignoring external research. And a researcher with a grievance publishing a working SYSTEM escalation with no patch available puts every Windows estate in the blast radius of a dispute it is not party to.

Both are true. Neither helps you this week.

What to do

• Assume local access equals SYSTEM on Windows right now. If your model of an initial foothold assumed the attacker stays at user level for a while, drop that assumption until the patch ships.
• Tighten what gets a foothold in the first place. This is a second-stage bug. It buys nothing without initial code execution, so the controls that matter are the ones on macros, downloads, attachments and untrusted binaries.
• Do not disable Defender. Trading real, active protection against everything else for one unproven local escalation is a bad trade.
• Watch for the out-of-band. Microsoft has confirmed it is working on an update but has not committed to a date, so this may not wait for September's Patch Tuesday.
• Keep offline backups current. Standard, and it is the control that survives a SYSTEM compromise.

What is not established

• Exploitation in the wild. Not confirmed by Microsoft or any vendor at the time of writing. Public PoC code makes it likelier, not proven.
• The full affected list. Windows 10 and the older Server editions are reported vulnerable on the strength of the technique, not tested results.
• A patch date. Microsoft has confirmed the work, not the timing.
• The zero-day count. Eight or nine, depending on who is counting.