ShieldBreak Zero-Day Bypasses Microsoft Defender Patch, Grants SYSTEM Access (PoC Released)

Security researcher Chaotic Eclipse has published a proof-of-concept exploit for a new Microsoft zero-day dubbed ShieldBreak, which the researcher claims fully bypasses the patch for CVE-2026-50656 (CVSS 7.8), a privilege escalation flaw in Microsoft Defender's Malware Protection Engine (mpengine.dll) previously known as RoguePlanet. The original RoguePlanet vulnerability is a race condition that allows attackers to spawn a shell with SYSTEM-level privileges, enabling arbitrary code execution. In a related side effect, Chaotic Eclipse reported that Microsoft's defense-in-depth updates for CVE-2026-50656 can cause Defender to leak 8 bytes of data when opening certain files on Windows 11 25H2 and Windows Server 2025.

ShieldBreak takes a different approach from RoguePlanet. According to researcher Kevin Beaumont, ShieldBreak uses a user-mode callback hook to alter file contents during a Defender cloud-hydration scan via cfapi (Cloud Filter API), whereas RoguePlanet exploited a filesystem race condition using virtual disks and NT native file manipulation to trick the quarantine process into overwriting system files. The PoC reportedly has a 100% success rate on the latest Windows 11 25H2 (including Canary builds) and Windows Server 2025. While Windows 10 is vulnerable, the researcher noted it is not currently supported by the exploit. Vulnerability analyst Will Dormann of Tharros independently validated the exploit, confirming that Defender must be enabled for ShieldBreak to work.

Microsoft has stated it is aware of the report and is actively investigating the claims, reiterating its commitment to coordinated vulnerability disclosure. Researchers and sysadmins tracking affected systems can use our port scanner to audit exposed endpoints and a WHOIS lookup to investigate any suspicious infrastructure tied to potential exploitation. Defender's built-in protections are the only explicit prerequisite for the exploit, making it a critical concern for organizations that rely on default security configurations.

With Chaotic Eclipse releasing a working PoC publicly, security teams should prioritize monitoring Microsoft advisories for an official patch, apply the principle of least privilege to limit the blast radius of SYSTEM-level compromise, and consider running a SSL/TLS checker across their endpoints to ensure transport-layer integrity while investigating. Until Microsoft addresses the bypass, environments running Defender on Windows 11 25H2 and Windows Server 2025 remain exposed to a relatively reliable local privilege escalation path.