A researcher known as Nightmare Eclipse has publicly released a zero-day flaw and working exploit,
called ShieldBreak, that abuses Microsoft Defender to give any logged-in user full SYSTEM control of a
Windows machine. It works reliably on the latest Windows 11 and Windows Server 2025, older
Windows is also vulnerable, and there is no patch yet, though it requires the attacker to already run
code on the machine and to have Defender switched on. The exploit is claimed to bypass Microsoft’s
earlier RoguePlanet fix (CVE-2026-50656); while no real-world attacks are reported yet, the public
exploit makes this a strong candidate for use in ransomware and hands-on intrusions.
1. Vulnerability Details
EXPLOIT STATUS : Publicly disclosed with a working proof-of-concept on 12 August 2026, the day after Patch Tuesday. There is no patch, and no in-the-wild exploitation has been reported. The PoC
reports a 100 per cent success rate on Windows 11 25H2 and Windows Server 2025; exploitation requires local code execution and an active Microsoft Defender.
ShieldBreak is a local privilege-escalation flaw that abuses Microsoft Defender’s scanning of cloud-synced files. The exploit registers a temporary folder as a cloud sync provider, plants an EICAR test file to trigger a Defender scan, and uses object-manager symlinks to redirect that scan toward System32. During the scan it abuses the Common Log File System (CLFS) and the Cloud Filter API to swap file content and write attacker code to C:\Windows\System32\phoneinfo.dll, a DLL that does not exist by default. It then triggers the QueueReporting scheduled task, which runs wermgr.exe with highest privileges and loads phoneinfo.dll, executing the attacker’s code and spawning a SYSTEM shell. The flaw requires Microsoft Defender to be active.
2. Affected Products
- Microsoft Windows 11, including 25H2 and the Canary channel, and Windows Server 2025. The public PoC reports a100 per cent success rate on these.
- Windows 10 and its server editions are also vulnerable, though the public PoC does not currently support them.
- Exploitation requires local code execution and an active Microsoft Defender. No patch is available, and Microsoft’s fix for the related RoguePlanet flaw (CVE-2026-50656) does not stop ShieldBreak.
3. Disclosure and Dispute
Nightmare Eclipse published ShieldBreak and a working exploit on 12 August 2026, the day after Patch Tuesday. No in the-wild exploitation has been reported.
- Confirmed working: Researcher Kevin Beaumont independently confirmed the exploit works on the latest Windows11 and gives SYSTEM from any user, and published detection and hunting content for it.
- RoguePlanet-bypass claim: Nightmare Eclipse frames ShieldBreak as a bypass of Microsoft’s RoguePlanet fix (CVE-2026-50656). Researcher Will Dormann notes the mechanism looks different from RoguePlanet and, unlike it, requires Defender to be active, so the bypass framing is unconfirmed.
4. Other Notable CVEs
- CVE-2026-50656 (CVSS Not published): RoguePlanet, the Windows Defender privilege-escalation flaw Microsoft patched and that Nightmare Eclipse claims ShieldBreak bypasses. The link is claimed by the researcher but disputed by other researchers.
5. Recommendations
- There is no patch yet: monitor for and apply a Microsoft fix for ShieldBreak as soon as it ships, and keep Microsoft Defender and its cloud-delivered protection fully updated in the meantime.
- Hunt for the exploit’s behaviour: a non-Defender process (outside the Windows Defender folders and System32) loading MpClient.dll, a process outside System32 or Program Files loading the Cloud Filter API cldapi.dll, and any single process loading both MpClient.dll and cldapi.dll within five minutes.
- Alert on the creation of C:\Windows\System32\phoneinfo.dll (which does not exist on a clean Windows install), a temporary directory newly registered as a cloud sync provider, and wermgr.exe -upload spawning a shell or conhost.exe as SYSTEM.
- Apply least privilege and application control (WDAC or AppLocker) to limit who can run untrusted binaries, since exploitation requires local code execution as a standard user.
6. Sources
- https://git.projectnightcrawler.dev/NightmareEclipse/ShieldBreak
- https://git.projectnightcrawler.dev/NightmareEclipse/ShieldBreak/src/branch/main/ShieldBrea
k.cpp - https://cyberplace.social/@GossiTheDog/117082623896479140
- https://infosec.exchange/@wdormann/117083141042272544
- https://github.com/GossiTheDog/ThreatHunting/blob/master/AdvancedHuntingQueries/ShieldBrea
k.kql
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.