Security researcher Nightmare Eclipse has released ShieldBreak, a zero-day exploit that bypasses Microsoft's patch for CVE-2026-50656, the RoguePlanet Microsoft Defender privilege-escalation flaw. The exploit installs a user-mode callback hook that alters file contents during a Defender cloud-hydration scan performed via the Cloud Filter API (cfapi), and is claimed to reach SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. It arrived shortly after Microsoft's August 2026 Patch Tuesday updates, deepening an existing dispute between the researcher and Microsoft over disclosure and bug-bounty practices.
Full bypass of the RoguePlanet patch
Nightmare Eclipse published ShieldBreak following the August 2026 Patch Tuesday security updates, presenting it as proof that Microsoft failed to correctly remediate the underlying RoguePlanet vulnerability. RoguePlanet was disclosed in June 2026 and patched by Microsoft in July 2026.
According to the researcher's release notes, the PoC was tested on the latest Windows 11 25H2 builds (including the Canary channel) and Windows Server 2025, with a claimed 100% success rate. Windows 10 and its corresponding server editions are not currently supported by the PoC, although the researcher states they remain vulnerable to the same technique. Nightmare Eclipse also said Microsoft Defender must be enabled for the exploit to work, a point independently confirmed by Will Dormann, principal vulnerability analyst at Tharros.
How the attack works
Cybersecurity expert Kevin Beaumont, who also published ShieldBreak exploitation detection queries for Microsoft Defender for Endpoint, stressed that the two exploits work very differently. RoguePlanet was a filesystem race condition that abused virtual disks and NT native file manipulation to trick Defender's quarantine process into overwriting system files. ShieldBreak instead relies on a user-mode callback hook to change file contents during a Defender cloud-hydration scan performed through the Cloud Filter API (cfapi).
The distinction matters for defenders: the attack surface is not the quarantine file-handling path patched for RoguePlanet, but the cloud-hydration callback path used during scanning.
Technical background
The Cloud Files API (cfapi) is the Windows mechanism that lets storage providers expose placeholder files that are materialized on demand when an application opens them. Products such as Microsoft Defender can lean on cloud-delivered protection, where file content is fetched from the cloud during a scan rather than read from local disk. This general class of bug is a time-of-check-to-time-of-use (TOCTOU) race: a lower-privileged process influences what a privileged scanner observes or persists between the moment content is checked and the moment it is used. A user-mode callback hook can shape the data delivered by the hydration path, and if tampered content is subsequently processed or written by a component running as SYSTEM, an attacker obtains a file-write primitive that can be chained into full SYSTEM access.
The following are generic hygiene examples, not ShieldBreak exploit or detection code:
# Verify current privilege context (generic)
whoami /priv
# Confirm the Microsoft Defender engine is running (generic)
Get-MpComputerStatus | Select-Object IsServiceRunning, AntivirusEnabled
// Generic skeleton only - not the ShieldBreak detection query
DeviceFileEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "MsMpEng.exe"
| summarize WriteCount = count() by FolderPath
| order by WriteCount desc
Detection and mitigation
Kevin Beaumont has published a Defender for Endpoint advanced-hunting query designed to surface ShieldBreak exploitation activity in his ThreatHunting repository: ShieldBreak.kql.
Until Microsoft ships a fix — the company is reportedly working on a Defender patch for the ShieldBreak zero-day — organizations should apply Patch Tuesday updates promptly, monitor cloud-hydration scan activity and Defender process file behavior, and restrict local privilege context for user accounts. Note that disabling Defender is not a viable mitigation, since the exploit specifically requires an active Defender engine.
Disclosure timeline and the Microsoft dispute
Since April 2026, Nightmare Eclipse has disclosed a string of zero-days — LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend — targeting Microsoft Defender, BitLocker, and other Windows components. Microsoft fixed RoguePlanet in July 2026 and addressed YellowKey, GreenPlasma, and MiniPlasma in the June 2026 Patch Tuesday, while the remaining flaws are still awaiting an official patch. Related coverage includes the LegacyHive zero-day granting admin access, the disgruntled researcher's BlueHammer leak, and the BitLocker zero-day PoC covering GreenPlasma. The researcher also maintains the UnDefend repository.
Microsoft's response
A Microsoft spokesperson told BleepingComputer that the company is aware of the reported vulnerability and is actively investigating the validity and potential applicability of the claims, while committing to investigate security issues and update impacted products as soon as possible. The spokesperson also voiced support for coordinated vulnerability disclosure, describing it as an industry standard that protects customers and supports the research community by ensuring findings are thoroughly investigated before public release.
Microsoft had previously responded to Nightmare Eclipse's disclosures with warnings of legal action against people engaging in malicious activity causing real harm to customers, which security experts interpreted as a direct threat to the researcher.