--- title: After Microsoft threatened legal action, a security... description: A security researcher going by Nightmare Eclipse has published a proof-of-concept for a new Windows zero-day dubbed ShieldBreak, which exploits a flaw in... canonical: https://daily.dev/posts/after-microsoft-threatened-legal-action-a-security-researcher-publishes-a-new-windows-zero-day-bug-g2g1eoohm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug | daily.dev og:description: A security researcher going by Nightmare Eclipse has published a proof-of-concept for a new Windows zero-day dubbed ShieldBreak, which exploits a flaw in... og:url: https://daily.dev/posts/after-microsoft-threatened-legal-action-a-security-researcher-publishes-a-new-windows-zero-day-bug-g2g1eoohm og:image: https://api.daily.dev/og/posts/g2g1EooHM.png og:image:alt: After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug **[TechCrunch](https://daily.dev/sources/tc)** · 3 min read · 0 upvotes · 0 comments ## Summary A security researcher going by Nightmare Eclipse has published a proof-of-concept for a new Windows zero-day dubbed ShieldBreak, which exploits a flaw in Windows Defender to escalate a low-level user to full system access. It affects Windows 10, Windows 11 25H2, and Windows Server 2025, and independent researcher Will Dormann confirmed it works, requiring Defender to be enabled. The bug builds on and reportedly bypasses Microsoft's earlier patch for a related exploit called RoguePlanet. Microsoft has not patched ShieldBreak yet and did not comment. This disclosure follows months of tension between the researcher and Microsoft, including a legal threat from Microsoft in May over unauthorized zero-day releases, which Microsoft later walked back on social media while leaving its original blog post unchanged. The release also comes a day after a Patch Tuesday cycle that fixed roughly 500 vulnerabilities, a volume Microsoft attributes partly to its growing use of AI in vulnerability hunting. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the ShieldBreak Windows zero-day vulnerability and which Windows versions does it affect? ShieldBreak is a zero-day exploit disclosed by security researcher Nightmare Eclipse that abuses a flaw in Windows Defender to escalate privileges from a low-level user to full system access. It affects Windows 10, Windows 11 including the 25H2 version, and Windows Server 2025. The proof-of-concept is distributed as a Windows app that a user must run for the exploit to trigger, and Windows Defender must be enabled for it to work. Microsoft has not released a patch. _Track unpatched Windows vulnerabilities like this one as they develop by following security coverage on daily.dev._ ### Has Microsoft patched the ShieldBreak Windows Defender exploit? No, Microsoft has not released a patch for ShieldBreak and a company spokesperson did not comment when asked. The exploit builds on an earlier bug called RoguePlanet, for which Microsoft did issue a fix (CVE-2026-50656), but the researcher behind ShieldBreak says it demonstrates a full bypass of that patch, meaning the underlying issue was not fully resolved. _Stay ahead of unresolved Windows security gaps by checking daily.dev for updates on the eventual fix._ ### Why did a security researcher publicly release a Windows zero-day instead of reporting it privately to Microsoft? Nightmare Eclipse released ShieldBreak publicly after a prolonged dispute with Microsoft over how the company handled prior bug reports, claiming mistreatment and inadequate response. In May, Microsoft published a blog post threatening legal action against researchers who disclose zero-days outside its official policy, drew backlash from the security community, and later walked back the comments on social media without editing or removing the original post. _Follow how vendor disclosure policies and researcher disputes evolve by checking daily.dev for security news._ ## Similar posts on daily.dev - [Nightmare-Eclipse Strikes Again with 'ShieldCrash' Windows Exploit](https://daily.dev/posts/nightmare-eclipse-strikes-again-with-shieldcrash-windows-exploit-3pp4wzefx) · Dark Reading · 0 upvotes · 0 comments - [Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges](https://daily.dev/posts/microsoft-defender-rogueplanet-zero-day-grants-system-privileges-ldyxflycj) · BleepingComputer · 1 upvotes · 0 comments - [Researcher creates workaround for Microsoft Defender security patch](https://daily.dev/posts/researcher-creates-workaround-for-microsoft-defender-security-patch-30gt7sysk) · CSO Online · 0 upvotes · 0 comments - [The researcher Microsoft threatened just dropped a seventh Windows zero-day hours after Patch Tuesday](https://daily.dev/posts/the-researcher-microsoft-threatened-just-dropped-a-seventh-windows-zero-day-hours-after-patch-tuesda-l1aucgx7d) · The Next Web · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft), [#windows](https://daily.dev/tags/windows), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/after-microsoft-threatened-legal-action-a-security-researcher-publishes-a-new-windows-zero-day-bug-g2g1eoohm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug","url":"https://daily.dev/posts/after-microsoft-threatened-legal-action-a-security-researcher-publishes-a-new-windows-zero-day-bug-g2g1eoohm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/after-microsoft-threatened-legal-action-a-security-researcher-publishes-a-new-windows-zero-day-bug-g2g1eoohm"},"datePublished":"2026-08-12T15:22:58.519Z","dateModified":"2026-08-17T09:10:49.932Z","description":"A security researcher going by Nightmare Eclipse has published a proof-of-concept for a new Windows zero-day dubbed ShieldBreak, which exploits a flaw in...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3b2fff1ef91bae3b7a3d2f8b6d7dfe9b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3b2fff1ef91bae3b7a3d2f8b6d7dfe9b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"TechCrunch","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"TechCrunch","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tc","url":"https://daily.dev/sources/tc"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/after-microsoft-threatened-legal-action-a-security-researcher-publishes-a-new-windows-zero-day-bug-g2g1eoohm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft,windows,zero-day","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"TechCrunch","item":"https://daily.dev/sources/tc"},{"@type":"ListItem","position":3,"name":"After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/after-microsoft-threatened-legal-action-a-security-researcher-publishes-a-new-windows-zero-day-bug-g2g1eoohm#faq","mainEntity":[{"@type":"Question","name":"What is the ShieldBreak Windows zero-day vulnerability and which Windows versions does it affect?","acceptedAnswer":{"@type":"Answer","text":"ShieldBreak is a zero-day exploit disclosed by security researcher Nightmare Eclipse that abuses a flaw in Windows Defender to escalate privileges from a low-level user to full system access. It affects Windows 10, Windows 11 including the 25H2 version, and Windows Server 2025. The proof-of-concept is distributed as a Windows app that a user must run for the exploit to trigger, and Windows Defender must be enabled for it to work. Microsoft has not released a patch. Track unpatched Windows vulnerabilities like this one as they develop by following security coverage on daily.dev."}},{"@type":"Question","name":"Has Microsoft patched the ShieldBreak Windows Defender exploit?","acceptedAnswer":{"@type":"Answer","text":"No, Microsoft has not released a patch for ShieldBreak and a company spokesperson did not comment when asked. The exploit builds on an earlier bug called RoguePlanet, for which Microsoft did issue a fix (CVE-2026-50656), but the researcher behind ShieldBreak says it demonstrates a full bypass of that patch, meaning the underlying issue was not fully resolved. Stay ahead of unresolved Windows security gaps by checking daily.dev for updates on the eventual fix."}},{"@type":"Question","name":"Why did a security researcher publicly release a Windows zero-day instead of reporting it privately to Microsoft?","acceptedAnswer":{"@type":"Answer","text":"Nightmare Eclipse released ShieldBreak publicly after a prolonged dispute with Microsoft over how the company handled prior bug reports, claiming mistreatment and inadequate response. In May, Microsoft published a blog post threatening legal action against researchers who disclose zero-days outside its official policy, drew backlash from the security community, and later walked back the comments on social media without editing or removing the original post. Follow how vendor disclosure policies and researcher disputes evolve by checking daily.dev for security news."}}]} ```