Microsoft Patch Tuesday curse: vengeful researcher drops Defender exploit granting SYSTEM privileges
Hundreds of bug fixes in Microsoft’s latest Patch Tuesday were undermined hours later by a new Windows Defender exploit.
Image by Cybernews.
- A researcher released ShieldBreak, an unverified Windows Defender zero-day that allegedly grants attackers SYSTEM-level privileges on fully patched systems.
- Nightmare Eclipse says ShieldBreak bypasses Microsoft's fix for CVE-2026-50656 and works on Windows 11 and Windows Server 2025.
- Microsoft has not confirmed the exploit, but the researcher's previous disclosures and real-world abuse give the claim credibility.
- The disclosure followed Microsoft's update for 421 vulnerabilities, highlighting concerns that rising flaw counts may not reflect real-world risk.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Microsoft’s latest Patch Tuesday addressed 236 Windows bugs, only for the disgruntled researcher Nightmare Eclipse to show up and punch a massive privilege escalation hole. It isn’t even new – the Windows Defender exploit bypasses the previous insufficient fix.
It’s already a tradition for the anonymous researcher Nightmare Eclipse, who blames Microsoft for ruining their life, to drop a new zero-day vulnerability immediately after a Patch Tuesday.
“New 0day in Defender, funny bug…,” the whole blog post of the researcher reads.
The new repository on GitHub and other platforms reveals a Windows Defender zero-day local privilege-escalation exploit, dubbed ShieldBreak. Attackers can run a simple script to allegedly gain SYSTEM-level privileges.
The researcher claims that proof of concept (PoC) was tested on fully patched Windows 11 25H2, including Canary channel and Windows Server 2025, and the PoC also has “a 100% success rate.”
“Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass,” the project’s readme document says.
The included screenshots demonstrate the exploit spawning a shell, where the whoami command returns the highest-privileged internal account “nt authority\system.”
ShieldBreak appears to exploit interactions among Microsoft Defender, Windows Cloud Files, and filesystem objects, tricking Defender into interacting with attacker-controlled files.
Microsoft’s previous advisory explains that the original RoguePlanet bug was squashed by updating the Microsoft Malware Protection Engine – no installation of updates was required.
“In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine,” the advisory said.
“In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.”
The new exploit hasn’t been independently verified. However, the researcher haven’t misrepresented their findings before, which lends credibility to the claims. Their personal repository already contains 10 disclosed hacks. Some of them have already been abused by threat actors in the wild.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Microsoft previously called the researcher’s personal vendetta an “unnecessary risk” that put users at risk and forced its security teams to work around the clock.
Nightmare Eclipse dropped the new exploit hours after Microsoft Patch Tuesday security updates were released. They address 421 vulnerabilities in total, 236 of them affecting Windows and 98 affecting Office.
Vendors have been fixing record numbers of CVEs using artificial intelligence to only disprove the “AI is fixing everything” narrative. Some experts warn that record breaking numbers vulnerability numbers often represent a noise, not a signal.
According to VulnCheck report, Anthropic reported more than 23,000 findings through Project Glasswing, but only 126 have resulted in published CVEs, and just one has been confirmed as exploited in the wild.
FIRST Forecasting team's mid-year report notes that the volume of GitHub Security Advisories (GHSA) is up 449%, and VulnCheck is up 3,119%.
"When filtering the massive volume surge for actual exploitability... the actionable patching burden remains completely flat, “ the report reads. “Total rainfall is up significantly, the actual flooding risk has not changed.”