--- title: Microsoft working on Defender patch for ShieldBreak zero-day description: Microsoft confirmed it is developing a patch for a Windows Defender zero-day dubbed "ShieldBreak," now tracked as CVE-2026-69414. Researcher Nightmare Eclipse... canonical: https://daily.dev/posts/microsoft-working-on-defender-patch-for-shieldbreak-zero-day-ytaehqgqv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Microsoft working on Defender patch for ShieldBreak zero-day | daily.dev og:description: Microsoft confirmed it is developing a patch for a Windows Defender zero-day dubbed "ShieldBreak," now tracked as CVE-2026-69414. Researcher Nightmare Eclipse... og:url: https://daily.dev/posts/microsoft-working-on-defender-patch-for-shieldbreak-zero-day-ytaehqgqv og:image: https://api.daily.dev/og/posts/YtaeHqgQv.png og:image:alt: Microsoft working on Defender patch for ShieldBreak zero-day og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft working on Defender patch for ShieldBreak zero-day **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Microsoft confirmed it is developing a patch for a Windows Defender zero-day dubbed "ShieldBreak," now tracked as CVE-2026-69414. Researcher Nightmare Eclipse disclosed it as a bypass of the previously patched RoguePlanet flaw, releasing a proof-of-concept exploit with a claimed 100% success rate on fully patched Windows 11 25H2, Canary channel, and Windows Server 2025 systems (Windows 10 is also vulnerable but unsupported). The disclosure came without prior notice to Microsoft, part of an ongoing dispute between the researcher and the company over its bug bounty and disclosure practices, following a string of prior zero-days (LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, UnDefend) targeting Defender, BitLocker, and other Windows components. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the ShieldBreak zero-day vulnerability in Microsoft Defender? ShieldBreak, tracked as CVE-2026-69414, is a privilege escalation vulnerability in the Microsoft Malware Protection Engine that bypasses the previously patched RoguePlanet flaw (CVE-2026-50656). A public proof-of-concept, released by researcher Nightmare Eclipse, lets local attackers with limited permissions gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems, with Defender enabled as a requirement for exploitation. _Track how Microsoft patches this Defender flaw as security teams follow the fix on daily.dev._ ### Has Microsoft released a patch for CVE-2026-69414 yet? No official patch is available yet; Microsoft confirmed it is working on a fix and will update the CVE entry once the security update ships. The vulnerability was disclosed by researcher Nightmare Eclipse without prior notice to Microsoft, and it remains unpatched as of the confirmation, three days after public disclosure. _Keep tabs on the patch timeline for this Defender zero-day via daily.dev._ ### On which Windows versions was the ShieldBreak proof-of-concept tested? The exploit was tested on Windows 11 25H2, including the Canary channel, and Windows Server 2025, with a claimed 100% success rate. Windows 10 and its corresponding server editions are also vulnerable but are no longer officially supported by Microsoft. _Security engineers assessing exposure across Windows versions can follow updates like this on daily.dev._ ## Similar posts on daily.dev - [Microsoft patches RoguePlanet Defender zero-day vulnerability](https://daily.dev/posts/microsoft-patches-rogueplanet-defender-zero-day-vulnerability-ddu6ytwlk) · BleepingComputer · 0 upvotes · 0 comments - [Nightmare-Eclipse Strikes Again with 'ShieldCrash' Windows Exploit](https://daily.dev/posts/nightmare-eclipse-strikes-again-with-shieldcrash-windows-exploit-3pp4wzefx) · Dark Reading · 0 upvotes · 0 comments - [Microsoft working on Defender patch for RoguePlanet zero-day](https://daily.dev/posts/microsoft-working-on-defender-patch-for-rogueplanet-zero-day-hn0khgmvw) · BleepingComputer · 0 upvotes · 0 comments - [Researcher creates workaround for Microsoft Defender security patch](https://daily.dev/posts/researcher-creates-workaround-for-microsoft-defender-security-patch-30gt7sysk) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#windows](https://daily.dev/tags/windows), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/microsoft-working-on-defender-patch-for-shieldbreak-zero-day-ytaehqgqv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Microsoft working on Defender patch for ShieldBreak zero-day","url":"https://daily.dev/posts/microsoft-working-on-defender-patch-for-shieldbreak-zero-day-ytaehqgqv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/microsoft-working-on-defender-patch-for-shieldbreak-zero-day-ytaehqgqv"},"datePublished":"2026-08-17T09:09:50.900Z","dateModified":"2026-08-17T09:10:51.056Z","description":"Microsoft confirmed it is developing a patch for a Windows Defender zero-day dubbed \"ShieldBreak,\" now tracked as CVE-2026-69414. Researcher Nightmare Eclipse...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/26499479e6287fa16e0d631aead7cb26?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/26499479e6287fa16e0d631aead7cb26?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/microsoft-working-on-defender-patch-for-shieldbreak-zero-day-ytaehqgqv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,windows,zero-day","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Microsoft working on Defender patch for ShieldBreak zero-day"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/microsoft-working-on-defender-patch-for-shieldbreak-zero-day-ytaehqgqv#faq","mainEntity":[{"@type":"Question","name":"What is the ShieldBreak zero-day vulnerability in Microsoft Defender?","acceptedAnswer":{"@type":"Answer","text":"ShieldBreak, tracked as CVE-2026-69414, is a privilege escalation vulnerability in the Microsoft Malware Protection Engine that bypasses the previously patched RoguePlanet flaw (CVE-2026-50656). A public proof-of-concept, released by researcher Nightmare Eclipse, lets local attackers with limited permissions gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems, with Defender enabled as a requirement for exploitation. Track how Microsoft patches this Defender flaw as security teams follow the fix on daily.dev."}},{"@type":"Question","name":"Has Microsoft released a patch for CVE-2026-69414 yet?","acceptedAnswer":{"@type":"Answer","text":"No official patch is available yet; Microsoft confirmed it is working on a fix and will update the CVE entry once the security update ships. The vulnerability was disclosed by researcher Nightmare Eclipse without prior notice to Microsoft, and it remains unpatched as of the confirmation, three days after public disclosure. Keep tabs on the patch timeline for this Defender zero-day via daily.dev."}},{"@type":"Question","name":"On which Windows versions was the ShieldBreak proof-of-concept tested?","acceptedAnswer":{"@type":"Answer","text":"The exploit was tested on Windows 11 25H2, including the Canary channel, and Windows Server 2025, with a claimed 100% success rate. Windows 10 and its corresponding server editions are also vulnerable but are no longer officially supported by Microsoft. Security engineers assessing exposure across Windows versions can follow updates like this on daily.dev."}}]} ```