ShieldBreak Zero-Day Bypasses Microsoft's Defender Patch

A security researcher who goes by Nightmare Eclipse published a working Microsoft Defender zero-day called ShieldBreak on August 12, one day after Microsoft shipped its August Patch Tuesday updates. The exploit takes a standard user account to SYSTEM on fully patched Windows 11 25H2 and Windows Server 2025, and the researcher reports a 100 percent success rate on both. No CVE has been assigned and no fix exists.

The detail that gives this one teeth is not that it is new. It is that it is a bypass. ShieldBreak defeats the patch Microsoft shipped in early July for RoguePlanet, tracked as CVE-2026-50656, which was itself a Defender privilege escalation bug from the same researcher. Microsoft closed that hole roughly a month after disclosure. Five weeks later the same outcome is reachable again by a different route through the same product.

RelatedMicrosoft Patches RoguePlanet Defender Zero-Day

The timing is not accidental either. In May, Microsoft published a blog post threatening legal action against researchers who release zero-day details outside its coordinated disclosure policy, a post widely read as aimed at this specific researcher after Microsoft deleted their bug report account and suspended their GitHub. The company walked the language back publicly after a backlash from the security industry, saying it had no intention of pursuing people conducting or publishing security research, but it never edited the original post. ShieldBreak is what that unresolved standoff looks like in practice.

What does ShieldBreak actually abuse?

The two bugs reach SYSTEM through completely different plumbing, which is why the July patch does nothing to stop the new one. RoguePlanet was a filesystem race condition built on virtual disks and NT native file manipulation. The attacker got Defender to scan a file, then swapped what was underneath it before the scan result was acted on.

ShieldBreak goes after the same time-of-check to time-of-use gap from a different direction. Kevin Beaumont, who examined the proof of concept, described it as a "user-mode callback hook" that changes file contents during a Defender cloud-hydration scan, using cfapi, the Windows Cloud Filter API. That is the interface behind placeholder files for services like OneDrive: the file looks present on disk, but its contents are fetched on demand when something reads it. Defender scanning one of those placeholders has to trigger that fetch, and the fetch runs through a provider callback in user mode. Whoever controls that callback controls what Defender receives, and can hand it one thing during the check and something else afterward.

Microsoft's July fix hardened the virtual-disk path. It never touched the cloud-hydration path, because that was not where the reported bug lived.

The practical shape of the attack matters for how worried you should be. The proof of concept ships as a Windows application that the victim has to run, which Will Dormann independently verified. That is a meaningful constraint: this is not a remote, clickless takeover. It is the second stage of an intrusion, the part that turns a phishing foothold or a malicious installer into full control of the host. Here is the short version:

• Affected: Windows 10, Windows 11 including 25H2, and Windows Server 2025, all fully patched as of August 2026. Only 25H2 and Server 2025 were tested, at 100 percent success; older builds are believed vulnerable but untested.
• Impact: a local, unprivileged user gets SYSTEM, which is total control of the machine.
• Status: public proof of concept, no CVE assigned, no patch, and no Microsoft statement as of publication.
• Constraint: requires the target to execute an application, so it is a privilege-escalation stage rather than an initial-access one.

Why is a patch bypass worse than a fresh bug?

A brand new vulnerability tells you a product has a flaw. A bypass tells you the vendor's model of the flaw was wrong. Microsoft looked at RoguePlanet, understood it as a virtual-disk race, and fixed that. The researcher's claim, backed by working code, is that the real problem is Defender's willingness to trust file contents it read a moment ago, and that fixing one way of exploiting that assumption leaves every other way intact. Cloud hydration was simply the next one in the drawer.

That has a cost beyond this single bug. Defenders who applied the July update reasonably marked the issue closed. They were correct about the CVE and wrong about the exposure, and there is no signal in any patch report that would have told them so. Incomplete fixes are also where the disclosure fight gets genuinely awkward: an incomplete patch usually merits its own CVE, but assigning one requires the vendor to acknowledge that the first fix was partial.

How did Microsoft and this researcher end up here?

ShieldBreak is the eighth zero-day this researcher has put out since April, alongside LegacyHive, BlueHammer, RedSun, YellowKey, GreenPlasma and MiniPlasma, most of them aimed at Defender and other Windows components. We have covered several of them as they landed: the six-exploit dump in July, the RoguePlanet patch, BlueHammer, and LegacyHive, which a third party patched before Microsoft did.

RelatedWindows LegacyHive Zero-Day Gets a Fix, Just Not From Microsoft

1. April 2026Nightmare Eclipse starts publishing Windows zero-days without coordinating with Microsoft Dispute is over bug bounty and disclosure practice
2. May 2026Microsoft threatens legal action over uncoordinated zero-day releases Researcher's bug report account deleted, GitHub suspended
3. June 2026Microsoft softens its position after industry backlash, but leaves the original post up Says it will not pursue security researchers
4. June 2026RoguePlanet disclosed: a Defender privilege escalation via filesystem race Later assigned CVE-2026-50656
5. Early July 2026Microsoft ships the RoguePlanet fix About one month after disclosure
6. Aug 11, 2026August Patch Tuesday lands, one exploited zero-day among hundreds of fixes Defender bypass not among them
7. Aug 12, 2026ShieldBreak published with a working proof of concept Full bypass of the July patch
8. NextA CVE for the incomplete fix, and a second patch Out-of-band, or September Patch Tuesday

What should defenders do while there is no patch?

Be clear-eyed about what is and is not known. Microsoft has published no advisory, no CVE and no mitigation guidance for this, and did not comment when TechCrunch and BleepingComputer approached it. Anyone offering you a specific Defender setting that stops ShieldBreak is guessing, because the vendor has not said which code path it will change.

What holds regardless is the assumption you should stop making. On any Windows host where a user can run an arbitrary executable, treat the gap between standard user and SYSTEM as closed, not as a security boundary you can lean on. That reframing is the actionable part: application control that stops unapproved binaries from executing is doing more work here than any Defender toggle, because the proof of concept needs execution to start. Monitoring is the other half. Unexpected process creation running as SYSTEM shortly after a user launched something, and unusual cloud placeholder activity around a Defender scan, are the observable artifacts of this class of attack even without a signature for this specific tool.

Our take

Microsoft's May legal threat looks worse with every one of these. The stated purpose of coordinated disclosure is to get users patched before attackers get code, and it works when researchers believe the process is worth their time. Deleting someone's bug report account and suspending their GitHub taught this researcher that the process was not worth their time, and the result is a full working exploit on the public internet with no fix available. The softened statement in June did not undo that, because the original post is still there and nothing about the underlying bounty dispute was resolved.

None of which makes dropping an unpatched SYSTEM exploit on a billion machines a neutral act. Everyone exposed here had no part in the argument. But the practical question for anyone running Windows is not who deserves blame; it is that Defender has now produced two paths to SYSTEM in three months from one researcher who is not being paid, is not coordinating, and has six more disclosures already in public. The realistic read is that ShieldBreak is not the last one.

Original analysis by GenZTech, based on reporting from TechCrunch, BleepingComputer and Security Affairs, Kevin Beaumont's public analysis of the proof of concept, and Microsoft's own May 2026 disclosure-policy post. The proof of concept is hosted on the researcher's own repository, which we do not link. Source: TechCrunch.