CVE-2026-69414 Shield Break Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days | Qualys
Summary: ShieldBreak (CVE-2026-69414) is a zero-day elevation-of-privilege flaw in the Microsoft Malware Protection Engine used by Microsoft Defender, letting a low-privilege local attacker escalate to SYSTEM; a public PoC was released on August 12, 2026, Microsoft assigned the CVE on August 14, and no patch is available yet. The exploit abuses how Defender processes files during cloud-file hydration, using a user-mode callback to interfere with file data received through the Cloud Filter API (CFAPI) plus Windows filesystem and Object Manager mechanisms to control which file Defender scans, and the PoC was reported to work on Windows 11 25H2 and Windows Server 2025.
What's compelling: A working public exploit that turns a low-privilege local account into NT AUTHORITY\SYSTEM is loose on Windows 11 25H2 and Windows Server 2025, and Microsoft's fix is still in development - so the window between PoC release and patch is entirely yours to cover.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-50656CVE-2026-69414
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026