ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access
- ID
- 13392
- Status
- summarized
- Published
- 12 Aug 2026, 2:41 PM
- Fetched
- 12 Aug 2026, 5:22 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.5
- Created
- 12 Aug 2026, 5:23 PM
- Tags
- Audience
- developersvibe_coders
What happened
A researcher going by 'Chaotic Eclipse' has published a proof-of-concept called ShieldBreak that claims to fully bypass Microsoft's patch for CVE-2026-50656 (RoguePlanet), a race condition in the Microsoft Defender Malware Protection Engine (mpengine.dll) that can grant SYSTEM-level privileges. The PoC reportedly has a 100% success rate on Windows 11 25H2 and Windows Server 2025, with Windows 10 also vulnerable but untested. Microsoft says it is investigating the patch bypass claim.
Why it matters
If you run Windows 11 25H2 or Windows Server 2025 in production or dev environments, this PoC means the existing Defender patch for CVE-2026-50656 does not actually protect you — an attacker with local access can still escalate to SYSTEM. Treat Defender's patch as insufficient and add compensating controls (restrict local user privileges, monitor for unexpected child processes from Defender's engine) until Microsoft ships a corrected patch.
Discussion angle
For teams running Windows Server 2025 in Malaysian enterprise or govtech environments, what compensating controls can you put in place right now given that the official Defender patch is bypassable with a public PoC?