Security Researcher Publishes Windows Defender 'ShieldBreak' Zero-Day, Says Microsoft Threatened Legal Action
A researcher known as Nightmare Eclipse disclosed an unpatched Windows Defender privilege-escalation flaw, saying Microsoft's legal threats left public disclosure as the only option.
Overview
A security researcher operating under the pseudonym Nightmare Eclipse has publicly disclosed an unpatched Windows Defender vulnerability called ShieldBreak, days after accusing Microsoft of threatening legal action against researchers who disclose zero-days outside the company’s own reporting process, according to TechCrunch. The flaw lets an attacker escalate from a standard user account to full SYSTEM privileges on fully patched Windows machines, according to BleepingComputer.
What We Know
ShieldBreak affects Windows 11 version 25H2, including its Canary channel, and Windows Server 2025, which BleepingComputer confirmed as vulnerable through testing. Windows 10 and its corresponding server editions are also believed to be affected but had not yet been tested at the time of publication, according to BleepingComputer. The exploit requires Microsoft Defender to be enabled and ships as a Windows application that a user must execute locally, according to TechCrunch — it is not a remote or wormable attack.
Technically, the exploit uses a user-mode callback hook to alter file contents during a Defender cloud-hydration scan through the Cloud Filter API, or cfapi, according to BleepingComputer. Nightmare Eclipse says the technique fully bypasses Microsoft’s fix for an earlier vulnerability the researcher also disclosed, RoguePlanet, tracked as CVE-2026-50656. “Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass,” the researcher said, according to BleepingComputer. RoguePlanet itself is described by the National Vulnerability Database as an elevation-of-privilege flaw in the Microsoft Malware Protection Engine, carrying a CVSS score of 7.0 (NVD’s assessment) or 7.8 (Microsoft’s own assessment), affecting Malware Protection Engine versions before 1.1.26060.3008. NVD published the RoguePlanet entry on June 16, 2026, and last updated it on August 12, 2026, the same day ShieldBreak was disclosed.
According to BleepingComputer, ShieldBreak is the ninth vulnerability Nightmare Eclipse has disclosed since April 2026 targeting Windows Defender, BitLocker, and other Windows components, part of an escalating dispute with Microsoft over how the company handles the researcher’s bug reports, according to BleepingComputer. TechCrunch reports that in May 2026, Microsoft published a blog post threatening legal action against security researchers who release zero-day details outside of its own disclosure policies, and later partially walked the comments back on social media, though the original post was left unedited, according to TechCrunch. Nightmare Eclipse has said Microsoft mishandled the researcher’s prior bug reports, leaving public disclosure as the only viable path, according to TechCrunch.
A Microsoft spokesperson said the company is “aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims,” according to both TechCrunch and BleepingComputer. No patch for ShieldBreak had been released as of publication.
What We Don’t Know
Microsoft has not confirmed whether it will pursue legal action against Nightmare Eclipse over the ShieldBreak disclosure, nor has it given a timeline for a patch. Neither TechCrunch nor BleepingComputer identified Nightmare Eclipse’s real-world identity or affiliation, and neither outlet published the exact text of Microsoft’s May 2026 blog post threatening legal action. It also remains unconfirmed whether the vulnerability has been exploited by anyone other than the researcher who disclosed it.