Security researcher Nightmare Eclipse has released ShieldBreak, a proof-of-concept exploit that defeats the patch Microsoft shipped five weeks ago for a Windows Defender privilege escalation flaw.
The researcher dropped the PoC code on GitHub and wrote that Microsoft has failed to properly patch the RoguePlanet vulnerability, CVE-2026-50656.
Two claims make ShieldBreak more dangerous than the exploit it replaces.
RoguePlanet was a race condition, and its reliability swung sharply from machine to machine. The researcher described it in June as hit or miss. ShieldBreak is listed with a 100 percent success rate.
The June exploit did not run on Windows Server, because standard users cannot mount ISO images there, though the researcher maintained server builds were vulnerable anyway. ShieldBreak is now listed as tested on Windows Server 2025, alongside Windows 11 25H2 and the Canary channel. Windows 10 stays vulnerable but unsupported by the current code. That pulls domain controllers and session hosts into scope for the first time.
The released code contains Warden.dll, a Report.wer Windows Error Reporting artifact, an eicar_com.zip antivirus test file, and supporting project files. The WER artifact is notable.
Analysts who dissected RoguePlanet in June described an attack chain built on NTFS junctions, opportunistic locks, and the Windows Error Reporting QueueReporting scheduled task, suggesting ShieldBreak reworks the same plumbing rather than opening a new front.
RoguePlanet surfaced on June 10 and targeted the Microsoft Malware Protection Engine, the scanner behind Defender, which runs as SYSTEM. It abused improper link resolution before file access to spawn a SYSTEM shell on fully updated machines. Microsoft rated it important at CVSS 7.8 and shipped engine build 1.1.26060.3008 on July 9. The Register reported that Redmond had closed every public zero-day the researcher disclosed.
It is the second fix in this class to fall. Microsoft hardened Defender's internal file-handling APIs in mid-May, and RoguePlanet was rewritten to defeat that. The release follows Microsoft's August Patch Tuesday, which fixed 421 CVEs on August 11. One of them touched Defender.
Nightmare Eclipse has published working exploits for unpatched Microsoft flaws since April, retaliation for what the researcher says was MSRC revoking their reporting access and refusing to pay bounties.
Previously disclosed flaws in the series include:
- BlueHammer (CVE-2026-33825)
- RedSun (CVE-2026-41091)
- UnDefend (CVE-2026-45498)
- YellowKey (CVE-2026-45585)
- GreenPlasma (CVE-2026-45586)
- MiniPlasma (CVE-2020-17103)
- RoguePlanet (CVE-2026-50656)
- GreatXML (CVE-2026-50661)
BlueHammer, RedSun, and UnDefend were exploited in real-world intrusions before fixes landed, and all three were added to CISA's Known Exploited Vulnerabilities catalog.
No patch exists for ShieldBreak, and no vendor has reproduced it publicly yet. ThreatLocker found that application allowlisting blocked RoguePlanet by default, the strongest control available for this bug class.
Microsoft had not commented on ShieldBreak at publication.