Microsoft has confirmed it is working on a ShieldBreak zero-day patch after the privilege escalation flaw in Microsoft Defender was publicly disclosed without warning late last week. The company has assigned the vulnerability CVE-2026-69414 and says a fix is coming, though no release date has been given.
The researcher behind the disclosure goes by the handle Nightmare Eclipse. The flaw, which Nightmare Eclipse described as a bypass for an earlier Defender vulnerability called RoguePlanet, was shared alongside a working proof-of-concept (PoC) exploit. According to the researcher, local attackers with limited permissions can use the PoC to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems, and the PoC carries a self-reported 100% success rate on Windows 11 25H2 (including the Canary channel) and Windows Server 2025.
Vulnerability analyst Will Dormann confirmed the exploit works, with one caveat: Microsoft Defender must be enabled on the target system for the privilege escalation to succeed.
ShieldBreak Zero-Day Patch: What Microsoft Has Said
Microsoft’s public statement, posted after the company began tracking the flaw, acknowledged the issue without crediting the researcher. ‘Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as “ShieldBreak,”‘ the company said. ‘We are working to provide a high quality security update that addresses this vulnerability. We will provide information in this CVE when the update is available.’
A Microsoft spokesperson had earlier told BleepingComputer: ‘Microsoft is committed to investigating security issues and updating impacted products to protect customers as soon as possible.’ The company has not, as of publication, publicly acknowledged Nightmare Eclipse as the finder.
A Running Dispute Over Disclosure and Bug Bounties
Nightmare Eclipse released ShieldBreak without any prior notice to Microsoft, framing it explicitly as a protest. ‘Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass,’ the researcher wrote. The decision to bypass coordinated disclosure is part of a longer-running disagreement with the company over its vulnerability disclosure and bug bounty practices.
The history of that dispute is worth tracing. According to Picus Security, Nightmare Eclipse is also tracked under the aliases Chaotic Eclipse and Dead Eclipse. Since April, the researcher has disclosed a string of zero-day exploits targeting Defender, BitLocker, and various other Windows components, each given a codename: LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend. Microsoft has patched some of them. YellowKey, GreenPlasma, and MiniPlasma were addressed in the June 2026 Patch Tuesday updates; RoguePlanet followed in July. Picus Security notes that BlueHammer, which carries a CVSS score of 7.8, was patched in April 2026. The remaining flaws, including ShieldBreak, are still awaiting fixes.
Understanding the mechanics of RoguePlanet matters here, because ShieldBreak is built on top of it. As Help Net Security reported when RoguePlanet was first disclosed, the vulnerability abuses a race condition in Windows Defender to spawn a command shell running with SYSTEM-level privileges. ShieldBreak, in Nightmare Eclipse’s own framing, demonstrates that Microsoft’s patch for that race condition was insufficient.
The conflict escalated sharply in the days after the PoC dropped. Microsoft issued warnings of legal action against people engaging in ‘malicious activity causing real harm’ to its customers, a statement many in the security community read as a direct threat aimed at the researcher. According to Cyderes, Nightmare Eclipse had already shown a pattern of quick repositioning: after Microsoft shipped the June 2026 Patch Tuesday fixes, the researcher resurfaced on GitHub under a new alias, MSNightmare, republishing the RoguePlanet repository within hours of the patches going live.
The researcher was also careful to set expectations on Windows 10 coverage: ‘Windows 10 (and respective server editions) are not currently supported, they are however vulnerable to ShieldBreak as well.’
CVE-2026-69414 has no patch date yet. Microsoft says it will update the CVE entry when a fix is ready, leaving Windows and Windows Server users in the meantime on systems where the ShieldBreak zero-day patch remains outstanding alongside several other unresolved Nightmare Eclipse disclosures.
