Microsoft working on Defender patch for ShieldBreak zero-day

Microsoft has confirmed it is developing a security update for CVE-2026-69414, a privilege escalation vulnerability in the Microsoft Malware Protection Engine known as "ShieldBreak." This flaw enables local attackers with limited permissions to gain SYSTEM-level access on fully patched versions of Windows 10, Windows 11, and Windows Server.

Disclosed by security researcher Nightmare Eclipse alongside a working proof-of-concept, ShieldBreak functions as a complete bypass for the previously addressed RoguePlanet vulnerability (CVE-2026-50656). While the exploit requires Microsoft Defender to be active, independent verification has confirmed its 100% success rate across modern Windows environments. Microsoft stated that it is actively working on a high-quality fix and will release further details once the patch becomes available.