Shield Break Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access
Summary: A researcher operating as Chaotic Eclipse released a proof-of-concept called ShieldBreak, which he claims is a full patch bypass for CVE-2026-50656 (RoguePlanet), a Defender race condition that yields SYSTEM privileges, and says it succeeded 100% of the time on Windows 11 25H2 and Windows Server 2025. Microsoft assigned it CVE-2026-69414 with a CVSS score of 7.8 and an exploitability rating of "Exploitation More Likely," saying it is investigating the claims, while researchers Kevin Beaumont and Will Dormann both confirmed the exploit works and described a mechanism distinct from RoguePlanet's.
Bottom line: The bypass lands in the same month Microsoft shipped fixes for 421 flaws, including an actively exploited WinSock zero-day (CVE-2026-68820) that CISA added to its KEV catalog with an August 25, 2026 federal deadline - so a Defender patch that a public PoC defeats at 100% success leaves the engine meant to catch everything else as the open door.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-50656CVE-2026-62832
- Related
- Microsoft Plugs Nearly 400 Security Holes Cyber Risks ·