Microsoft has confirmed that it is working on a security update for a newly disclosed Microsoft Defender zero-day vulnerability known as “ShieldBreak.”
The privilege escalation flaw was disclosed by a security researcher using the “Nightmare Eclipse” handle shortly after Microsoft released its August 2026 Patch Tuesday security updates.
“Microsoft is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims,” a Microsoft spokesperson said.
The company added that it is committed to investigating security issues and updating affected products as quickly as possible.
Nightmare Eclipse described ShieldBreak as a bypass for RoguePlanet, another Microsoft Defender privilege escalation vulnerability disclosed in June.
The researcher also released a proof-of-concept (PoC) exploit showing how attackers with limited local permissions could potentially escalate their privileges to SYSTEM on fully updated Windows systems.
The researcher said the PoC was tested on Windows 11 25H2, including the Canary channel, as well as Windows Server 2025, and claimed it had a 100% success rate in those tests.
Windows 10 and its corresponding Server editions were not supported by the released PoC, although the researcher said those systems remain vulnerable to ShieldBreak.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Security researcher Will Dormann also confirmed that the ShieldBreak exploit works, while noting that Microsoft Defender must be enabled for an attacker to successfully perform the privilege escalation.
Microsoft Confirms Defender ShieldBreak Zero-Day, Patch in Development
