--- title: "Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)" url: https://daily.dev/posts/microsoft-defender-patch-bypass-high-severity-zero-day-privilege-escalation-cve-2026-50656-roguepl-iyr8lsrej source_url: https://arcticwolf.com/resources/blog/cve-2026-50656-rogueplanet-shieldbreak type: article source: "Arctic Wolf" published: 2026-08-12T21:26:14.650Z updated: 2026-08-17T09:10:49.932Z tags: ["security", "windows", "zero-day"] reading_time: 3 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak) **[Arctic Wolf](https://daily.dev/sources/arcticwolf)** · 3 min read · 0 upvotes · 0 comments ## Summary A high-severity zero-day privilege escalation vulnerability (CVE-2026-50656, dubbed RoguePlanet) in Microsoft Defender's Malware Protection Engine lets low-privilege local users escalate to SYSTEM via a race condition and improper link resolution. Microsoft patched it in Engine v1.1.26060.3008 in July 2026, but on August 12, 2026 the same researcher, alias Chaotic Eclipse, released a bypass exploit chain called ShieldBreak that fully defeats the patch, restoring SYSTEM access on up-to-date systems. All current Windows 10, 11 (25H2, Canary), and Windows Server 2025 platforms running Defender are affected. There is no official fix for the ShieldBreak bypass yet. Recommended mitigations include patch validation, blocking vulnerable binaries, restricting local admin rights, application allowlisting, Attack Surface Reduction rules, Tamper Protection, and Secure Boot/VBS rollback protections, none of which fully substitute for a patch. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-50656 and how does the ShieldBreak exploit bypass the Microsoft Defender patch? CVE-2026-50656, nicknamed RoguePlanet, is a privilege escalation flaw in Microsoft Defender's Malware Protection Engine (mpengine.dll) that lets a low-privilege local user reach NT AUTHORITY\SYSTEM via a race condition and improper link resolution. Microsoft patched it in Engine v1.1.26060.3008 in July 2026, but researcher Chaotic Eclipse released ShieldBreak on August 12, 2026, a full bypass that restores SYSTEM access even on patched systems. _Security teams tracking Windows privilege escalation exploits can follow disclosures like this one on daily.dev._ ### Is there an official fix for the ShieldBreak Microsoft Defender bypass? No, there is no official Microsoft fix for the ShieldBreak bypass at the time it was disclosed. Engine versions below 1.1.26060.3008 remain vulnerable to the original RoguePlanet flaw, and the ShieldBreak exploit defeats that patch entirely, so mitigation currently relies on compensating controls like Attack Surface Reduction rules, Tamper Protection, restricted local admin rights, and application allowlisting rather than a patch. _Teams building layered defenses while waiting on a vendor patch can track advisories like this via daily.dev._ ### Which Windows versions are affected by the Microsoft Defender RoguePlanet and ShieldBreak vulnerabilities? All current Windows platforms running Microsoft Defender are affected, including Windows 10, Windows 11 (25H2 and Canary channels), and Windows Server 2025. The exploit chain is entirely local, requiring no network-based indicators of compromise, so detection depends on host-based behavioral monitoring of processes like MsMPEng.exe. _Admins auditing endpoint exposure across Windows fleets can keep tabs on advisories like this through daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#windows](https://daily.dev/tags/windows), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/microsoft-defender-patch-bypass-high-severity-zero-day-privilege-escalation-cve-2026-50656-roguepl-iyr8lsrej)