A privilege escalation flaw in Microsoft Defender that lets an attacker with only basic access to a Windows machine seize full administrative control has been public for more than two weeks, and Microsoft still has not shipped a fix.
The vulnerability, tracked as CVE-2026-69414 and nicknamed “ShieldBreak” by the researcher who published it, sits inside the Microsoft Malware Protection Engine, the scanning component at the heart of Windows Defender. In plain terms, it lets someone who already has a limited foothold on a Windows computer, such as a standard user account with no special rights, trick Defender into running their own malicious code with SYSTEM privileges. SYSTEM is the highest level of access on a Windows machine, above even a local administrator account, and getting it typically means an attacker can do essentially anything on that device.
The flaw affects Windows 10, Windows 11 (including the 25H2 release), and Windows Server 2025, as long as Defender is installed and actively scanning files. It carries a CVSS severity score of 7.8 out of 10.
How the attack works
According to technical write-ups from security researchers who tested the exploit, the attack chain is unusually intricate for a Defender bug. It starts by planting a harmless industry-standard test file (known as an EICAR file, commonly used to check that antivirus software is working) in a location designed to catch Defender’s attention. The attacker then uses a Windows feature called Object Manager symlinks to redirect where Defender actually looks when it goes to scan that file, pointing it instead toward a sensitive system folder.
From there, the exploit abuses the Windows Common Log File System to swap the identity of a legitimate system file for a malicious one named phoneinfo.dll. When Defender’s own background reporting task later runs with elevated permissions, it loads that malicious file instead of the real one, and the attacker’s code executes with SYSTEM rights.
Notably, ShieldBreak works by getting around a patch Microsoft had already released earlier this month for a separate, related flaw called RoguePlanet (CVE-2026-50656). In effect, the fix for one bug opened a path to a new one.
Disclosure and confirmation
The flaw was published on August 11 by a researcher who goes by several handles, including Nightmare-Eclipse, Chaotic Eclipse and MSNightmare, who has previously released proof-of-concept exploits for other Windows and Defender components. According to reporting from The Hacker News, the researcher did not notify Microsoft before making the details public and claimed the exploit worked reliably every time it was run.
Independent security researchers Will Dormann and Kevin Beaumont both separately tested the proof-of-concept and confirmed it functions as described on Windows 11, with Dormann reporting a 100 percent success rate in his own testing.
Microsoft assigned the CVE identifier on August 14, three days after the public disclosure, and acknowledged the issue in a statement reported by BleepingComputer: “Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as ‘ShieldBreak.'” The company said it was “working to provide a high quality security update that addresses this vulnerability” but did not commit to a release date.
As of the most recent public update tracked by the security vendor Qualys on August 20, no patch had been released. Qualys advised organizations to apply compensating mitigations in the meantime rather than wait for an official fix, since exploiting the flaw requires only that Defender be running, which is the default configuration on the vast majority of Windows machines.
There is no confirmed evidence so far of ShieldBreak being used in real-world attacks. The risk comes from the fact that working exploit code is already public, which lowers the bar for less skilled attackers to use it once they have gained any initial foothold on a target system, for example through phishing or a separate vulnerability.
What organizations can do
Because there is no official patch yet, security teams are largely limited to detection and compensating controls: monitoring for the unusual symlink and scheduled-task behavior described in researchers’ technical write-ups, restricting who can run code locally on sensitive machines, and watching vendor channels closely for Microsoft’s eventual security update. Organizations using endpoint detection platforms should check whether their vendor has published detection rules specific to CVE-2026-69414.
Sources: The Hacker News, BleepingComputer, and Qualys.
