ShieldBreak was CVE-2026-69414, CVSS 7.8, in Microsoft Defender's Malware Protection Engine. Microsoft fixed it in engine version 1.1.26080.3, distributed automatically, no customer action required.
A researcher publishing as Chaotic Eclipse has now released ShieldCrash, a proof of concept that reaches the same bug anyway.
In their words:
Microsoft has failed to properly patch ShieldBreak CVE-2026-69414. Under specific conditions it is still possible to trigger the exact same problem.
Microsoft closed several exploitable paths, the researcher says, and missed a spot. The demonstration reads an arbitrary file with SYSTEM privileges, on all supported Windows desktop versions.
There is no new CVE. It is filed as a patch bypass against the original, which means a scanner checking whether you have engine 1.1.26080.3 will report you fixed, and you will be.
Why a partial fix is its own category
A vulnerability everybody knows about gets attention. A vulnerability everybody believes is fixed gets none.
The engine version check passes. The advisory is closed. The dashboard is green. Whatever process an organisation has for tracking unpatched issues will not surface this, because by every mechanical definition it is patched — and the only thing saying otherwise is a researcher's post.
That is the same shape as the four N-central hotfixes in five weeks, the first of which was itself an incomplete fix for an authentication bypass. Incomplete patches are not rare and they are systematically under-tracked, because the tracking systems key on identifiers and an incomplete fix reuses the old one.
The same researcher, and an answer to an open question
Chaotic Eclipse is one of the names behind the Nightmare Eclipse releases — PrettyPrague against Avast, FalconFlank against CrowdStrike Falcon, GreenSection against NVIDIA's display driver.
When we covered that set, one loose end was flagged: Kaspersky appeared in Kevin Beaumont's confirmation that the exploits worked, but was not among the three named releases, and nobody had explained why.
The reporting on ShieldCrash lists this researcher's recent output as CrowdStrike Falcon Sensor, Kaspersky, Avast and NVIDIA. So Kaspersky was a target, not a reporting artefact. That closes the question this site left open, and it is worth saying rather than quietly dropping.
Five vendors in about a fortnight: Avast, CrowdStrike, Kaspersky, NVIDIA, Microsoft. Four of the five are security products. That is not a coincidence of interest — it is where the privilege is.
Microsoft has not responded
No Microsoft statement on the bypass has been published, and no new CVE has been assigned.
Until one is, there is nothing for a patch process to consume. The practical position is that Defender on a fully updated Windows desktop has a known, publicly demonstrated arbitrary-file-read-as-SYSTEM, and the vendor has not said whether it agrees.
What to do
- Do not treat "engine 1.1.26080.3" as closure. The version is correct and the bug is reachable.
- Watch for a Microsoft response or a second engine update, and check the engine version rather than the Windows build — the engine updates on its own schedule.
- Assume arbitrary file read as SYSTEM is available on your desktops while this stands, and consider what that reads: credential material, configuration, anything a user cannot normally open.
- This needs local code execution first. It is an escalation, not an entry point, which puts it in the same bracket as the two exploited flaws in this month's Patch Tuesday.
- If you track vulnerabilities by CVE, you will miss this class entirely. Patch bypasses do not get new identifiers, so somebody has to be reading rather than querying.
What is not established
- Whether Microsoft agrees it is unfixed. No response published.
- Whether it has been exploited. No evidence of real-world use.
- The specific conditions under which the original bug is still reachable. The researcher describes the result, not the trigger.
- Whether a new CVE will be assigned, and therefore whether it will ever appear in a scanner.
