A New Zero-Day Exploit in Microsoft Defender Allows System Privileges Grab
In a shocking revelation, a security researcher known as Nightmare Eclipse has unleashed a new zero-day exploit in Microsoft Defender called ShieldBreak. This vulnerability is particularly concerning because it can be used to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. The disturbing fact is that this exploit bypasses the previously disclosed RoguePlanet flaw, which was supposed to be fixed by Microsoft’s latest Patch Tuesday updates.
The ShieldBreak exploit relies on a previously unpatched vulnerability in the RoguePlanet bug, which Nightmare Eclipse had warned about since June. According to the researcher, the PoC (proof-of-concept) code for ShieldBreak has been successfully tested on the latest versions of Windows 11 and Windows Server 2025, boasting a 100% success rate. Notably, while Windows 10 systems are currently unsupported by this exploit, they are still vulnerable.
Microsoft Defender’s role in facilitating the ShieldBreak exploit is crucial. As Will Dormann, principal vulnerability analyst at Tharros, confirmed, the exploit only works when Microsoft Defender is enabled on the system. This raises questions about Microsoft’s patching strategy and its ability to effectively safeguard users’ systems against known vulnerabilities.
The release of ShieldBreak marks yet another incident in an ongoing dispute between Nightmare Eclipse and Microsoft over the company’s vulnerability disclosure and bug bounty practices. Since April, Nightmare Eclipse has disclosed multiple zero-day exploits targeting various Windows components, including LegacyHive, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend. Despite some of these vulnerabilities being patched in June and July, others remain unaddressed.
The implications of the ShieldBreak exploit are significant. Attackers can use this vulnerability to gain SYSTEM privileges, potentially leading to devastating consequences for users’ systems and data. As such, it is essential that users prioritize patching their systems and staying informed about the latest security developments.
In light of these findings, readers should take immediate action to protect themselves against potential attacks. The first step is to ensure that Microsoft Defender is enabled on your system and that all Windows updates are installed. Regularly reviewing security logs and monitoring for suspicious activity will also help detect any potential issues early on.
Source: Bleeping Computer — 2026-08-12