# ShieldBreak: Windows Defender Cloud-Hydration Zero-Day Bypasses RoguePlanet Patch (CVE-2026-50656) for SYSTEM-Level Privilege Escalation

> Pseudonymous researcher Nightmare Eclipse published ShieldBreak, a public local privilege-escalation exploit that abuses Microsoft Defender's cloud-hydration scanning (Cloud Filter API) plus Object Manager symbolic links, CLFS file-identity swapping, and the built-in QueueReporting Windows Error Reporting scheduled task to plant and force-load a rogue phoneinfo.dll as NT AUTHORITY\SYSTEM. It is a full patch bypass of RoguePlanet (CVE-2026-50656, fixed July 2026) with a claimed 100% success rate on fully patched Windows 11 25H2 and Windows Server 2025.

- **Published:** 2026-08-14T00:00:00Z
- **Last reviewed:** 2026-08-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2020
- **ID:** TL-2026-2020
- **Severity:** CRITICAL (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Nightmare Eclipse
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-50656

## Description

ShieldBreak is a local privilege-escalation (LPE) proof-of-concept published on GitHub (github.com/MSNightmare/ShieldBreak) by researcher Nightmare Eclipse (aliases Chaotic Eclipse, MSNightmare, INFINITE NIGHTMARE) on August 12, 2026, hours after that month's Patch Tuesday (which fixed 421 bugs). It targets Microsoft Defender's Malware Protection Engine (mpengine.dll) and is presented by its author as a full bypass of the fix Microsoft shipped for RoguePlanet (CVE-2026-50656), a race condition/improper-link-resolution flaw (CWE-59 / CWE-362, CVSS 3.1 base score 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in the same engine that Microsoft patched on July 9, 2026 in Malware Protection Engine 1.1.26060.3008.

Where RoguePlanet abused a filesystem race condition against virtual disks and NT-native file manipulation to trick the quarantine process into overwriting system files, ShieldBreak takes a structurally different path, per independent technical breakdowns from Kevin Beaumont and Will Dormann (Tharros Labs): it registers a temporary directory as a Cloud Sync Provider against the Cloud Filter API (cfapi) so it can install a user-mode callback hook that fires and alters file content during Defender's cloud-hydration scan. The exploit plants an EICAR test file to force that scan, uses Object Manager symbolic links to redirect Defender's scan path into %SystemRoot%\System32, and leverages the Common Log File System (CLFS) to swap the identity file and hydration data underneath Defender mid-scan so that a malicious phoneinfo.dll (a filename that does not exist by default in System32) is written to that path. It then triggers the built-in QueueReporting Windows Error Reporting scheduled task, which runs wermgr.exe with elevated privileges; wermgr.exe's wer.dll module contains explicit code that loads phoneinfo.dll from System32, and because the attacker's file now occupies that path it is loaded and spawns a conhost.exe child process running as NT AUTHORITY\SYSTEM, completing the escalation from any local (including standard, unprivileged) account. Vendor detection guidance (Arctic Wolf) additionally flags token-duplication behavior around this chain and notes the technique depends on defeating Microsoft Defender Tamper Protection, since it manipulates Defender's own scanning engine against itself.

The author reports a 100% success rate against fully patched Windows 11 25H2 (including the Canary/Insider channel) and Windows Server 2025; Windows 10 and its server-equivalent editions are believed vulnerable by the same logic but are not natively supported by the published PoC code, and Dormann confirmed Microsoft Defender must be actively enabled on the target for the callback hook to fire. Independent researcher SecurityAura (@SecurityAura) additionally found ShieldBreak did not succeed when a third-party EDR was registered as the system's primary antivirus/Security Center provider, and that once Defender was re-enabled as primary, it detected the raw ShieldBreak.exe binary itself under signature name Exploit:Win32/NghtMrShldBrk.BB — an immediately actionable detection data point despite the underlying bypass having no vendor fix. As of August 14, 2026, Microsoft says only that it is 'aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims,' and no dedicated fix for the ShieldBreak bypass has shipped.

ShieldBreak is the ninth or tenth zero-day Nightmare Eclipse has released against Microsoft since beginning a self-described 'scorched-earth' disclosure campaign in early April 2026 (prior releases include BlueHammer/CVE-2026-33825, RedSun/CVE-2026-41091, UnDefend/CVE-2026-45498, YellowKey/CVE-2026-45585, GreenPlasma/CVE-2026-45586, MiniPlasma/CVE-2020-17103, GreatXML/CVE-2026-50661 — a June 10, 2026 BitLocker bypass abusing the Windows Recovery Environment trust boundary and artifacts left by a Defender Offline Scan, CVSS 6.1 — RoguePlanet/CVE-2026-50656, and LegacyHive/CVE-2026-62832, a Windows User Profile Service privilege-escalation patched in the same August 2026 update cycle ShieldBreak dropped hours after), following a dispute with Microsoft over bug-bounty and coordinated-disclosure policy that included a May 2026 legal threat from Microsoft that the company withdrew by the end of June 2026 after community backlash. Following ShieldBreak's publication, GitHub and GitLab suspended the researcher's account(s); the PoC has since been mirrored to git.churchofmalware.org and git.projectnightcrawler.dev.

## MITRE ATT&CK

- T1587.004 Exploits
- T1588.006 Vulnerabilities
- T1053.005 Scheduled Task
- T1129 Shared Modules
- T1574.001 DLL
- T1134 Access Token Manipulation
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools

## Sources

- [The Good, the Bad and the Ugly in Cybersecurity – Week 33](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-33-8/)
- [ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access](https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html)
- [New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges](https://www.bleepingcomputer.com/news/security/new-microsoft-defender-shieldbreak-zero-day-grants-system-privileges/)
- [Nightmare Eclipse Drops Windows Zero-Day Exploit 'ShieldBreak'](https://www.securityweek.com/nightmare-eclipse-drops-windows-zero-day-exploit-shieldbreak/)
- [Microsoft-vendetta hacker has a new zero day that gives system privileges on fully patched Windows](https://www.theregister.com/cyber-crime/2026/08/12/microsoft-vendetta-hacker-has-a-new-zero-day-that-gives-system-privileges-on-fully-patched-windows/5286889)
- [Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)](https://arcticwolf.com/resources/blog/cve-2026-50656-rogueplanet-shieldbreak/)
- [Nightmare-Eclipse Drops ShieldBreak Windows Defender 0-day vulnerability](https://cybersecuritynews.com/nightmare-eclipse-drops-shieldbreak-0-day/)
- [CVE-2026-50656 "RoguePlanet": Microsoft Defender Malware Protection Engine Privilege Escalation to SYSTEM](https://threat-modeling.com/cve-2026-50656-rogueplanet-microsoft-defender-privilege-escalation/)
- [MSNightmare/ShieldBreak: Windows Defender 0day vulnerability](https://github.com/MSNightmare/ShieldBreak)
- [CVE-2026-50656 vulnerability details](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656)
- [Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges](https://thehackernews.com/2026/07/microsoft-patches-rogueplanet-defender.html)
- [CVE-2026-50656 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-50656)
- [Will Dormann: "While it claims to be a RoguePlanet bypass, I..." (technical breakdown of the ShieldBreak exploit chain)](https://infosec.exchange/@wdormann/117083141042272544)
- [SecurityAura on ShieldBreak: EDR-coexistence testing and Defender's Exploit:Win32/NghtMrShldBrk.BB detection](https://x.com/SecurityAura/status/2087542291284025444)
- [GreatXML: Exploiting the WinRE trust boundary behind BitLocker](https://www.threatlocker.com/blog/greatxml-exploiting-the-winre-trust-boundary-behind-bitlocker)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2020