A new Microsoft Defender zero-day exploit has been disclosed by a security researcher, allowing attackers to gain SYSTEM privileges on fully patched Windows systems. The exploit, named “ShieldBreak,” was released just days after Microsoft’s August 2026 Patch Tuesday security updates.
The vulnerability is particularly concerning because it bypasses another previously patched flaw in Microsoft Defender known as RoguePlanet (CVE-2026-50656). According to the researcher, Nightmare Eclipse, ShieldBreak can be used to gain SYSTEM privileges on Windows 10, Windows 11, and Windows Server systems. What’s more, this exploit works even when Microsoft Defender is enabled, which is typically seen as a protective measure.
The ShieldBreak exploit is part of an ongoing dispute between Nightmare Eclipse and Microsoft over the company’s vulnerability disclosure practices. The researcher has been disclosing various zero-day exploits targeting Microsoft Defender and other Windows components since April 2026, but Microsoft has yet to patch most of them. In fact, only two of the disclosed vulnerabilities have received official patches so far.
To gain SYSTEM privileges using ShieldBreak, attackers need valid credentials. Once they have these, Microsoft Defender’s protection drops significantly, with only 37% of their actions being blocked. This is a stark reminder that prevention scores can be misleading and don’t tell the whole story when it comes to security. The Blue Report 2026 highlights this issue, showing that overall prevention scores can hide what happens after initial access.
It’s worth noting that Microsoft has been facing criticism for its handling of vulnerability disclosures and bug bounty practices. The company has warned Nightmare Eclipse of potential legal action against individuals engaging in “malicious activity causing real harm” to its customers. This warning has sparked debate among cybersecurity experts, who see it as a direct threat to the researcher.
As news of ShieldBreak spreads, Microsoft is likely to face even more scrutiny over its security practices and vulnerability disclosure policies. In the meantime, users are advised to remain vigilant and keep their systems up-to-date with the latest patches. While this exploit may not be publicly available for use by malicious actors, it highlights the importance of prioritizing patching and staying informed about potential vulnerabilities.
Ultimately, this incident serves as a reminder that security is an ongoing process, and even the most well-intentioned measures can have weaknesses. By staying aware of these risks and taking proactive steps to secure their systems, users can minimize their exposure to potential threats.
Source: Bleeping Computer — 2026-08-12