On August 11/12, 2026, security researcher Nightmare Eclipse (also known by the handle MSNightmare) published the ShieldBreak proof of concept. The exploit is claimed to completely bypass Microsoft's July 2026 patch for the Windows Defender vulnerability RoguePlanet (CVE-2026-50656) and achieve SYSTEM privileges on current platforms — including Windows 11 25H2 (including Canary builds) and Windows Server 2025 — with a claimed success rate of 100%.

Independent validation by Kevin Beaumont and Will Dormann indicates that the PoC works as long as Microsoft Defender is enabled. According to the researcher, Windows 10 and the corresponding Windows Server editions are also affected, although they are not yet supported by the current PoC.

Background: From RoguePlanet to ShieldBreak

Technical Comparison

“RoguePlanet was a filesystem race condition vuln that uses virtual disks and NT native file manipulation to trick quarantine process into overwriting system files. ShieldBreak [is a] user-mode callback hook to change file contents during a Defender cloud-hydration scan via cfapi (Cloud Filter API).”

— Kevin Beaumont

Detailed ShieldBreak Exploit Flow

The PoC combines several legitimate Windows mechanisms into a single privilege-escalation chain. The following phases summarize the most important steps visible in the source code and public technical analyses.

1. Preparation and Cloud Provider Registration

   The exploit creates a hidden working directory under C:\ShieldBreak_<GUID> and registers its own cloud sync provider named “Flubber” using CfRegisterSyncRoot. It then creates a placeholder named BERLIN with CfCreatePlaceholders. At this stage, the actual file contents do not yet exist and are supplied later through a hydration callback.

2. Object Manager Namespace Manipulation

   Using undocumented or rarely used NT APIs such as NtCreateDirectoryObjectEx and NtCreateSymbolicLinkObject, the exploit creates Object Manager directories and symbolic links inside the restricted namespace \BaseNamedObjects\Restricted\. Shadow directories are used to construct a path that appears to point Defender at the placeholder but can be redirected dynamically at runtime. A representative scan path looks approximately like this:

   \\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_<GUID>\WD_SCAN\BERLIN

3. Triggering the Defender Scan with an EICAR Bait File

   The exploit uses the MpClient interface — including MpManagerOpen and MpScanStart with a resource scan — to launch a targeted Defender scan against the prepared path. When Defender attempts to hydrate the file, the CfApi callback initially supplies the embedded EICAR test file from the eicar_com.zip resource. Defender detects the test malware and begins its remediation process.

4. Content Swap and Path Redirection During Remediation

   During the cleanup and quarantine phase, the callback changes the data being supplied. Instead of EICAR, it now delivers the payload DLL Warden.dll using restart hydration. At the same time, the Object Manager symbolic links are redirected. By combining a UNC loopback path such as \\127.0.0.1\C$ with an Alternate Data Stream named :stream, the file ultimately lands as C:\Windows\System32\phoneinfo.dll. Because Defender performs the write operation with SYSTEM privileges, the attacker can place the file in this otherwise protected location.

5. File Locking, WER Task and Payload Activation

   The planted file is mapped using CreateFileMapping with the SEC_IMAGE flag, effectively locking it. The exploit then starts the Windows Error Reporting task “QueueReporting” under \Microsoft\Windows\Windows Error Reporting through Task Scheduler. A named pipe at \\.\pipe\SHIELDBREAK coordinates the subsequent execution flow. The payload, Warden.dll, can then become active in a privileged context. When the chain succeeds, the PoC reports “Exploit succeeded.” and removes temporary artifacts.

Why the Existing Patch Does Not Stop ShieldBreak

The RoguePlanet fix primarily addressed the race condition involving virtual disks, junctions and the traditional quarantine path. ShieldBreak takes a different route:

• The Cloud Filter API allows a registered provider to supply file contents only when hydration occurs and to change those contents dynamically.
• The Object Manager can redirect paths from the perspective of another process — in this case Defender — without relying on traditional NTFS junction behavior.
• Defender's remediation workflow runs with elevated privileges, meaning a redirected write operation can result in the creation or replacement of protected system files.

For that reason, ShieldBreak is better understood as a new attack technique rather than a conventional bypass of the exact same root cause. The researcher nevertheless describes the PoC as a full patch bypass because the protection introduced for RoguePlanet does not prevent the new exploitation chain.

Impact and Detection

A successful exploitation elevates a standard local user to NT AUTHORITY\SYSTEM. No kernel exploit or memory-corruption primitive is required — Microsoft Defender itself becomes the privilege-escalation vehicle. The attack requires Defender to be active and the attacker to be able to execute the PoC or a modified derivative locally.

Recommendations for Administrators

• Until an official fix is available, deploy the detection and hunting queries published by Kevin Beaumont in Microsoft Defender for Endpoint or implement equivalent behavioral detections in other EDR platforms.
• Systems on which Microsoft Defender is fully disabled because another antivirus product has taken over are not affected by this specific Defender-dependent attack path.
• Monitor the registration of new Cloud Filter API providers and unusual Object Manager objects created in the restricted namespace.
• Track the Microsoft Malware Protection Engine version closely and deploy Defender platform, engine and Windows security updates promptly once Microsoft ships additional mitigations.

Conclusion

ShieldBreak once again demonstrates the security risks created when highly privileged system components such as Microsoft Defender interact with powerful and complex Windows APIs such as the Cloud Filter API and the Object Manager. The disclosure also comes amid ongoing tensions between the researcher and Microsoft, including previously reported legal threats.

Until Microsoft provides an official fix or mitigation, organizations should closely monitor the behavioral indicators associated with this attack chain and pay particular attention to Defender engine versions, cloud-filter provider activity and unusual Object Manager operations.