Full research report
ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access
Executive assessment
ShieldBreak centres on CVE-2026-50656, not the three other August Windows CVEs mentioned alongside it. Official records confirm a local privilege-escalation vulnerability in Microsoft's Malware Protection Engine, and the public GitHub repository confirms that demonstrative code is available. The claim that this code defeats Microsoft's remediation and reliably obtains SYSTEM remains attributable to Chaotic Eclipse; no Microsoft validation or independent reproduction was found. CISA's active-exploitation evidence applies to CVE-2026-68820, a separate WinSock driver flaw, and must not be presented as evidence that ShieldBreak is being exploited.
What happened
Microsoft previously addressed CVE-2026-50656, known as RoguePlanet, an elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine. On 11 August 2026, researcher Chaotic Eclipse published ShieldBreak code and claimed it fully bypassed Microsoft's earlier protections, with reporting following on 12 August. The repository and underlying CVE are independently verifiable, but Microsoft confirmation of the bypass and evidence of real-world ShieldBreak exploitation were not found.
Affected scope
The underlying CVE affects the Microsoft Malware Protection Engine used by Microsoft Defender. The researcher reports successful testing on Windows 11 25H2, including Canary builds, and Windows Server 2025, while claiming Windows 10 and corresponding server editions are also vulnerable; those detailed ShieldBreak version claims remain unconfirmed by Microsoft.
Technical assessment
CVE-2026-50656 is a local elevation-of-privilege weakness associated with improper link resolution before file access in the Defender Malware Protection Engine. NVD records local access, low privileges and no user interaction, with successful exploitation affecting confidentiality, integrity and availability. ShieldBreak is claimed to circumvent Microsoft's earlier remediation and obtain SYSTEM-level execution, but that bypass result currently rests on the researcher's code and claims rather than a revised Microsoft advisory.
Recommended defensive actions
- Update Microsoft Defender security intelligence, antimalware engine and platform components to the newest available releases across all supported Windows systems.
- Monitor Microsoft's CVE-2026-50656 advisory for a revised fix or explicit acknowledgement of the ShieldBreak bypass, then deploy any replacement update urgently.
- Inventory Windows 11 25H2 and Windows Server 2025 systems, prioritising hosts where untrusted or low-privilege users can execute local code.
- Restrict local code execution and administrative access on multi-user endpoints and servers until Microsoft clarifies whether the earlier remediation remains effective.
- Hunt for unexpected SYSTEM-level process creation following Defender file-scanning activity, while treating this as a hypothesis-led hunt rather than a validated ShieldBreak indicator.
Uncertainties and evidence gaps
- Microsoft had not publicly confirmed the ShieldBreak bypass claim in the reviewed evidence.
- No confirmed in-the-wild exploitation of ShieldBreak or CVE-2026-50656 was found.
- The claimed 100% success rate and exposure of Windows 10 and corresponding server editions have not been independently reproduced in the reviewed sources.
- No validated indicators of compromise or reliable product build boundaries for ShieldBreak were published.
- The supplied reporting identifies CVE-2026-62832, but the reviewed sources did not establish its distinct role in this event.
- The supplied reporting identifies CVE-2026-72971, but the reviewed sources did not establish its distinct role in this event.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Public PoC code is available for a claimed patch bypass of CVE-2026-50656; no confirmed active exploitation of ShieldBreak was found.
The investigation separated the ShieldBreak claim from Microsoft's much broader August security release and from CVE-2026-68820, whose exploitation CISA confirmed independently. The original reporting led to the researcher's public repository, while NVD and Microsoft records established that CVE-2026-50656 is a real Defender elevation-of-privilege vulnerability. The evidence supports public PoC availability and a credible bypass claim, but not confirmed active exploitation or vendor confirmation that the prior patch is ineffective.
- What event was being reported and when?Read the supplied article and followed its references to the researcher, Microsoft and CISA.thehackernews.com ↗
The article reports an 11 August 2026 ShieldBreak disclosure claiming a full bypass for the earlier CVE-2026-50656 remediation, with no Microsoft confirmation at publication.
why This established that the focused event was a claimed Defender patch bypass, while the other August CVEs were contextual patch-release items.
- Did the researcher publish primary technical material?Opened the linked Project Nighthawk disclosure page.blog.projectnightcrawler.dev ↗
The site presented a security-verification challenge, so its substantive disclosure text could not be verified.
why The inaccessible page could not support technical or scope claims and was excluded from the reference lists.
- Does Microsoft recognise the underlying vulnerability?Opened Microsoft's CVE-2026-50656 Security Update Guide entry.msrc.microsoft.com ↗
A vendor record exists for CVE-2026-50656, although the dynamically rendered page did not expose enough content to verify a Microsoft response to ShieldBreak.
why This supports attribution of the underlying vulnerability to Microsoft Defender but leaves the patch-bypass status unresolved.
- Was exploitation confirmed for ShieldBreak or only for another vulnerability in the article?Reviewed CISA's 11 August Known Exploited Vulnerabilities alert.cisa.gov ↗
CISA identified CVE-2026-68820 as exploited but did not list CVE-2026-50656 in this alert.
why CISA's evidence cannot be transferred to ShieldBreak; the article's confirmed active exploitation statement concerns a separate Windows vulnerability.
- What does an independent government vulnerability record confirm about RoguePlanet?Reviewed the National Vulnerability Database entry for CVE-2026-50656.nvd.nist.gov ↗
NVD describes an elevation of privilege in the Microsoft Malware Protection Engine, records a local low-privilege attack vector, identifies improper link resolution and references both Microsoft and the ShieldBreak repository.
why This independently confirms the vulnerable component and defensive significance, but it does not establish active exploitation or validate the bypass success rate.
- Is public PoC or exploit code actually available?Opened and inspected the public ShieldBreak repository.github.com ↗
The repository is public and contains C++ source, project files and supporting artefacts labelled as a Windows Defender zero-day demonstration.
why This confirms PoC availability, while repository publication alone does not prove reliability, affected-version breadth or malicious deployment.
- Are the additional stated CVEs part of ShieldBreak?Reviewed the NVD record for CVE-2026-62832.nvd.nist.gov ↗
CVE-2026-62832 is a separate local elevation-of-privilege flaw in Windows User Profile Service involving improper link resolution.
why Its different component confirms it belongs to broader August patch context rather than the ShieldBreak event.
- Does the publicly disclosed container vulnerability describe the same weakness?Reviewed the NVD record for CVE-2026-72971.nvd.nist.gov ↗
CVE-2026-72971 affects the Windows Container Isolation FS Filter Driver and permits local tampering.
why This further separates contextual Patch Tuesday reporting from the Defender-focused ShieldBreak claim.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (2 primary, 2 corroborating, 1 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1665 records | Primary evidence2 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. Supplied independent analysis opened and verified during focused research. |
| The Hacker Newsnews | ok10 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| NVDcve | ok900 records | Corroborating1 matched items | Supplied independent analysis opened and verified during focused research. |
| FIRST EPSSepss | ok7602 records | Context2 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok11 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5324 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok682 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1008 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok8 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok13 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Rapid7news | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok6 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 10 opened outside the registered collection
Vulnerability & exploitation3
PoC & exploit code1
Public repository containing source code and artefacts for the claimed Microsoft Defender patch bypass.
Vendor & gov advisories1
Microsoft's vendor record for the RoguePlanet elevation-of-privilege vulnerability in the Malware Protection Engine.
Analysis & research3
Confirms the Defender Malware Protection Engine vulnerability, local low-privilege access requirement and ShieldBreak repository reference.
Reports the researcher's 11 August 2026 disclosure and records that Microsoft had not yet confirmed the bypass claim.
Confirms exploitation of the separate CVE-2026-68820, not ShieldBreak or CVE-2026-50656.