New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges

A new zero-day vulnerability dubbed 'ShieldBreak' has been disclosed by security researcher Nightmare Eclipse, exploiting a bypass in Microsoft Defender that allows privilege escalation to SYSTEM level on fully patched Windows 10, 11, and Server systems. The flaw effectively circumvents the patch for CVE-2026-50656 (RoguePlanet), which Microsoft had previously addressed. The exploit has been successfully tested on Windows 11 25H2 (Canary) and Windows Server 2025 with a 100% success rate. Microsoft Defender must be enabled for the exploit to work, and the vulnerability remains unpatched at the time of publication.

AI-extracted · verify before operational use