Threat reportVulnerabilityTL-2026-2020
ShieldBreak: Windows Defender Cloud-Hydration Zero-Day Bypasses RoguePlanet Patch (CVE-2026-50656) for SYSTEM-Level Privilege Escalation
ShieldBreak: Windows Defender Cloud-Hydration Zero-Day (TL-2026-2020), also tracked as RoguePlanet Patch Bypass, is a critical-severity software vulnerability scored CVSS 7.8, first published 2026-08-14. It is attributed to Nightmare Eclipse with low confidence, affects Microsoft Microsoft Defender / Malware Protection Engine, references 1 CVE (CVE-2026-50656), maps to 8 MITRE ATT&CK techniques (T1036.005, T1053.005, T1129), and is covered by 9 detection rules and 16 indicators of compromise.
- CVSS
- 7.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 8MITRE ATT&CK
- Actors
- 1Nightmare Eclipse
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-2020
- Threat ID
- TL-2026-2020
- Also known as
- RoguePlanet Patch Bypass, ShieldBreak
- Severity
- CRITICAL
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- Nightmare Eclipse
- Attribution confidence
- LOW
- Motivation
- HACKTIVISM
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in ShieldBreak: Windows Defender Cloud-Hydration Zero-Day
Malware and tooling: Windows10, GreatXML, LegacyHive, ShieldBreak
How ShieldBreak: Windows Defender Cloud-Hydration Zero-Day works
Pseudonymous researcher Nightmare Eclipse published ShieldBreak, a public local privilege-escalation exploit that abuses Microsoft Defender's cloud-hydration scanning (Cloud Filter API) plus Object Manager symbolic links, CLFS file-identity swapping, and the built-in QueueReporting Windows Error Reporting scheduled task to plant and force-load a rogue phoneinfo.dll as NT AUTHORITY\SYSTEM. It is a full patch bypass of RoguePlanet (CVE-2026-50656, fixed July 2026) with a claimed 100% success rate on fully patched Windows 11 25H2 and Windows Server 2025.
ShieldBreak is a local privilege-escalation (LPE) proof-of-concept published on GitHub (github.com/MSNightmare/ShieldBreak) by researcher Nightmare Eclipse (aliases Chaotic Eclipse, MSNightmare, INFINITE NIGHTMARE) on August 12, 2026, hours after that month's Patch Tuesday (which fixed 421 bugs). It targets Microsoft Defender's Malware Protection Engine (mpengine.dll) and is presented by its author as a full bypass of the fix Microsoft shipped for RoguePlanet (CVE-2026-50656), a race condition/improper-link-resolution flaw (CWE-59 / CWE-362, CVSS 3.1 base score 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in the same engine that Microsoft patched on July 9, 2026 in Malware Protection Engine 1.1.26060.3008.
Where RoguePlanet abused a filesystem race condition against virtual disks and NT-native file manipulation to trick the quarantine process into overwriting system files, ShieldBreak takes a structurally different path, per independent technical breakdowns from Kevin Beaumont and Will Dormann (Tharros Labs): it registers a temporary directory as a Cloud Sync Provider against the Cloud Filter API (cfapi) so it can install a user-mode callback hook that fires and alters file content during Defender's cloud-hydration scan. The exploit plants an EICAR test file to force that scan, uses Object Manager symbolic links to redirect Defender's scan path into %SystemRoot%\System32, and leverages the Common Log File System (CLFS) to swap the identity file and hydration data underneath Defender mid-scan so that a malicious phoneinfo.dll (a filename that does not exist by default in System32) is written to that path. It then triggers the built-in QueueReporting Windows Error Reporting scheduled task, which runs wermgr.exe with elevated privileges; wermgr.exe's wer.dll module contains explicit code that loads phoneinfo.dll from System32, and because the attacker's file now occupies that path it is loaded and spawns a conhost.exe child process running as NT AUTHORITY\SYSTEM, completing the escalation from any local (including standard, unprivileged) account. Vendor detection guidance (Arctic Wolf) additionally flags token-duplication behavior around this chain and notes the technique depends on defeating Microsoft Defender Tamper Protection, since it manipulates Defender's own scanning engine against itself.
The author reports a 100% success rate against fully patched Windows 11 25H2 (including the Canary/Insider channel) and Windows Server 2025; Windows 10 and its server-equivalent editions are believed vulnerable by the same logic but are not natively supported by the published PoC code, and Dormann confirmed Microsoft Defender must be actively enabled on the target for the callback hook to fire. Independent researcher SecurityAura (@SecurityAura) additionally found ShieldBreak did not succeed when a third-party EDR was registered as the system's primary antivirus/Security Center provider, and that once Defender was re-enabled as primary, it detected the raw ShieldBreak.exe binary itself under signature name Exploit:Win32/NghtMrShldBrk.BB — an immediately actionable detection data point despite the underlying bypass having no vendor fix. As of August 14, 2026, Microsoft says only that it is 'aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims,' and no dedicated fix for the ShieldBreak bypass has shipped.
ShieldBreak is the ninth or tenth zero-day Nightmare Eclipse has released against Microsoft since beginning a self-described 'scorched-earth' disclosure campaign in early April 2026 (prior releases include BlueHammer/CVE-2026-33825, RedSun/CVE-2026-41091, UnDefend/CVE-2026-45498, YellowKey/CVE-2026-45585, GreenPlasma/CVE-2026-45586, MiniPlasma/CVE-2020-17103, GreatXML/CVE-2026-50661 — a June 10, 2026 BitLocker bypass abusing the Windows Recovery Environment trust boundary and artifacts left by a Defender Offline Scan, CVSS 6.1 — RoguePlanet/CVE-2026-50656, and LegacyHive/CVE-2026-62832, a Windows User Profile Service privilege-escalation patched in the same August 2026 update cycle ShieldBreak dropped hours after), following a dispute with Microsoft over bug-bounty and coordinated-disclosure policy that included a May 2026 legal threat from Microsoft that the company withdrew by the end of June 2026 after community backlash. Following ShieldBreak's publication, GitHub and GitLab suspended the researcher's account(s); the PoC has since been mirrored to git.churchofmalware.org and git.projectnightcrawler.dev.
MITRE ATT&CK techniques used in TL-2026-2020
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location
Execution
T1053.005 Scheduled Task; T1129 Shared Modules
Privilege Escalation
T1134 Access Token Manipulation
stealth
Resource Development
T1587.004 Exploits; T1588.006 Vulnerabilities
defense-impairment
Affected products and versions in ShieldBreak: Windows Defender Cloud-Hydration Zero-Day
- Microsoft — Microsoft Defender / Malware Protection Engine (mpengine.dll)
Vulnerable versions: < 1.1.26060.3008 (RoguePlanet, CVE-2026-50656); >= 1.1.26060.3008 (ShieldBreak patch-bypass; no official fix as of 2026-08-14)
Fixed in: RoguePlanet fixed in Malware Protection Engine 1.1.26060.3008 (July 2026); ShieldBreak has no vendor fix - Microsoft — Windows 11
Vulnerable versions: 25H2; 25H2 Canary / Insider channel - Microsoft — Windows Server 2025
Vulnerable versions: all editions, fully patched - Microsoft — Windows 10
Vulnerable versions: believed vulnerable by the same underlying flaw; not natively supported by the published PoC code
Remediation for ShieldBreak: Windows Defender Cloud-Hydration Zero-Day
Patches
- Malware Protection Engine 1.1.26060.3008 (July 9, 2026) remediates the original RoguePlanet race condition only; it does NOT close the ShieldBreak bypass
Immediate actions
- There is no official Microsoft fix for the ShieldBreak patch bypass as of 2026-08-14; do not treat the July 2026 RoguePlanet patch (Malware Protection Engine 1.1.26060.3008) as closing CVE-2026-50656
- Restrict interactive/local logon on high-value Windows 11 25H2 and Windows Server 2025 hosts running Microsoft Defender until a fix ships
- Alert on wermgr.exe spawning conhost.exe (or other unexpected children) with an NT AUTHORITY\SYSTEM token immediately following a QueueReporting scheduled-task run
- Verify Microsoft Defender's own signature detection is enabled and current: Defender detects the raw ShieldBreak.exe PoC binary as Exploit:Win32/NghtMrShldBrk.BB when it is registered as the primary AV/Security Center provider (per independent testing by SecurityAura)
Workarounds
- Where feasible, disable Microsoft Defender cloud-delivered protection / cloud hydration on the highest-risk hosts, since ShieldBreak requires Defender to be actively enabled to trigger
- Registering a third-party EDR as the primary antivirus/Security Center provider was independently observed to prevent ShieldBreak from succeeding
Longer-term hardening
- Deploy EDR/behavioral detections for unauthorized Cloud Sync Provider (cfapi) registrations and unexpected Object Manager symbolic-link/junction creation
- Alert on creation of phoneinfo.dll, or any new unsigned file, under %SystemRoot%\System32
- Audit for token-duplication activity, MsMPEng.exe/wermgr.exe anomalies, and Tamper Protection state changes on Defender-protected hosts (Arctic Wolf detection guidance)
- Track MSRC updates to CVE-2026-50656 for an eventual ShieldBreak-specific remediation
CVEs associated with ShieldBreak: Windows Defender Cloud-Hydration Zero-Day
Weaknesses (CWE) in ShieldBreak: Windows Defender Cloud-Hydration Zero-Day
Timeline of ShieldBreak: Windows Defender Cloud-Hydration Zero-Day
- Nightmare Eclipse begins a self-described 'scorched-earth' campaign of Windows zero-day disclosures against Microsoft (starting with BlueHammer), of which ShieldBreak is the ninth or tenth release.
- Microsoft threatens legal action against Nightmare Eclipse over non-coordinated vulnerability disclosure practices.
- RoguePlanet, a race condition/improper-link-resolution flaw in Microsoft Defender's mpengine.dll, is disclosed as a zero-day by Nightmare Eclipse.
- Nightmare Eclipse discloses GreatXML (CVE-2026-50661), a BitLocker bypass abusing the Windows Recovery Environment trust boundary and artifacts left by a Microsoft Defender Offline Scan, days before RoguePlanet is publicly acknowledged.
- Microsoft publicly acknowledges the RoguePlanet elevation-of-privilege vulnerability and assigns CVE-2026-50656.
- Microsoft retreats from its legal threats against Nightmare Eclipse following backlash from the security community.
- Microsoft patches RoguePlanet via Malware Protection Engine update 1.1.26060.3008 during the July 2026 update cycle.
- Nightmare Eclipse publishes a technical write-up of the ShieldBreak patch bypass on their blog (blog.projectnightcrawler.dev).
- Microsoft patches LegacyHive (CVE-2026-62832), a Nightmare Eclipse-disclosed Windows User Profile Service privilege-escalation flaw, during the August 2026 Patch Tuesday cycle (421 bugs fixed) that ShieldBreak is released hours after.
- Researcher SecurityAura reports ShieldBreak fails when a third-party EDR is registered as the system's primary antivirus provider, and that Microsoft Defender itself detects the raw ShieldBreak.exe binary as Exploit:Win32/NghtMrShldBrk.BB once re-enabled as primary.
- Independent researchers Kevin Beaumont and Will Dormann (Tharros Labs) confirm ShieldBreak works against the latest Windows 11 build and publish detailed technical breakdowns distinguishing its cfapi/CLFS/phoneinfo.dll mechanism from RoguePlanet's; GitHub and GitLab subsequently suspend Nightmare Eclipse's account(s) and the PoC is mirrored to git.churchofmalware.org and git.projectnightcrawler.dev.
- Microsoft states it is 'aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims.'
- The ShieldBreak PoC is published on GitHub (MSNightmare/ShieldBreak) hours after August 2026 Patch Tuesday, claiming a full RoguePlanet patch bypass with a 100% SYSTEM-privilege-escalation success rate on fully patched Windows 11 25H2 and Windows Server 2025.
- SentinelOne covers ShieldBreak in its 'Week 33' cybersecurity roundup, the source that surfaced this threat.
Sources cited for ShieldBreak: Windows Defender Cloud-Hydration Zero-Day
- The Good, the Bad and the Ugly in Cybersecurity – Week 33
- ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access
- New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges
- Nightmare Eclipse Drops Windows Zero-Day Exploit 'ShieldBreak'
- Microsoft-vendetta hacker has a new zero day that gives system privileges on fully patched Windows
- Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)
- Nightmare-Eclipse Drops ShieldBreak Windows Defender 0-day vulnerability
- CVE-2026-50656 "RoguePlanet": Microsoft Defender Malware Protection Engine Privilege Escalation to SYSTEM
- MSNightmare/ShieldBreak: Windows Defender 0day vulnerability
- CVE-2026-50656 vulnerability details
- Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges
- CVE-2026-50656 Detail
- Will Dormann: "While it claims to be a RoguePlanet bypass, I..." (technical breakdown of the ShieldBreak exploit chain)
- SecurityAura on ShieldBreak: EDR-coexistence testing and Defender's Exploit:Win32/NghtMrShldBrk.BB detection
- GreatXML: Exploiting the WinRE trust boundary behind BitLocker
Detection coverage for TL-2026-2020
As of 2026-08-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2020 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.