A complete bypass of a patch released a month ago

On August 12, 2026, just hours after the release of August's Patch Tuesday security updates, the security researcher known by the pseudonyms Nightmare Eclipse, Chaotic Eclipse, INFINITE NIGHTMARE, or MSNightmare publicly released a new zero-day exploit named "ShieldBreak."

This exploit does not target an unknown vulnerability but is a bypass (patch bypass) of the fix that Microsoft deployed a month earlier for the RoguePlanet flaw, identified under the identifier CVE-2026-50656 (CVSS score: 7.8). According to the researcher, "Microsoft did not properly patch the RoguePlanet vulnerability," and the PoC is a striking demonstration of this.

A privilege escalation in the Defender engine

The RoguePlanet vulnerability, initially disclosed in June 2026, resides in the Microsoft Malware Protection Engine (mpengine.dll), the analytical core of Microsoft Defender. It is a race condition that, once exploited, allows an attacker to generate a shell with SYSTEM privileges — the highest access level in Windows — enabling them to execute arbitrary code or perform unauthorized actions.

Microsoft classified RoguePlanet as a privilege escalation issue and deployed what it termed "defense-in-depth updates" in July 2026. However, shortly after the release of this patch, Chaotic Eclipse reported that the updates introduced to address CVE-2026-50656 could cause an 8-byte data leak when Defender attempts to open a file in certain scenarios on Windows 11 25H2 and Windows Server 2025. Microsoft then indicated that it was "aware of the report" and investigating.

ShieldBreak goes further: it is a complete bypass of the patch, not just a collateral effect.

An exploit tested with 100% success

The researcher claims to have tested the PoC on the latest versions of Microsoft's operating system, with perfect results:

  • Windows 11 25H2 (including the Canary channel);
  • Windows Server 2025.

The success rate is reported to be 100%. The researcher also specifies that Windows 10 and its corresponding Server editions are vulnerable to ShieldBreak, although the current PoC does not yet support them ("not currently supported").

However, one essential condition must be met for the exploit to work: Microsoft Defender must be enabled on the target machine. Will Dormann, principal vulnerability analyst at Tharros, confirmed on August 12 that the exploit does indeed work and corroborated this prerequisite.

A systematic campaign against the Microsoft ecosystem

ShieldBreak is part of an impressive series of disclosures made by Nightmare Eclipse since April 2026. The researcher has consecutively published the following zero-day exploits targeting Microsoft Defender, BitLocker, and various other Windows components:

Name Target Patch Status
LegacyHive Windows User Profile Service Patched in August 2026 (CVE-2026-62832)
RoguePlanet Microsoft Malware Protection Engine Patched in July 2026 (CVE-2026-50656), bypassed by ShieldBreak
BlueHammer Windows Component Patch pending
RedSun Windows Component Patch pending
YellowKey Windows Component Patched in June 2026
GreenPlasma Windows Component Patched in June 2026
MiniPlasma Windows Component Patched in June 2026
UnDefend Microsoft Defender Patch pending

This sustained cadence illustrates the researcher's determination to put pressure on Microsoft, but also the extent of residual flaws in the publisher's security products.

An open conflict with Microsoft

Beyond the technical aspect, ShieldBreak is also an extension of an open conflict between Microsoft and Nightmare Eclipse regarding the vulnerability disclosure and bug bounty practices of the Redmond giant. Microsoft reacted to the researcher's disclosures with warnings of legal action against individuals engaging in "malicious activity causing real harm" to its customers. Several cybersecurity experts have interpreted these statements as a direct threat against the researcher, raising questions about the freedom of security research and the right to alert on critical flaws.

Microsoft had not responded to requests from BleepingComputer and The Hacker News at the time of publication.

The context of the August 2026 Patch Tuesday

The disclosure of ShieldBreak coincides with the release of the August 2026 Patch Tuesday, which addresses a significant volume of vulnerabilities. Sources slightly differ on the numbers: BleepingComputer reports approximately 400 vulnerabilities, including 3 zero-days, while The Hacker News advances the figure of 421 vulnerabilities, with 236 specifically in Windows.

Several notable patches have been deployed:

  • CVE-2026-62832 (CVSS 7.8) — privilege escalation in the Windows User Profile Service, disclosed by Chaotic Eclipse under the name LegacyHive last month. This link following type flaw allows an authenticated attacker to load another user's registry hive and gain administrative privileges.
  • CVE-2026-68820 (CVSS 7.0) — zero-day flaw actively exploited in the Windows Ancillary Function Driver for WinSock, allowing escalation to SYSTEM. The CISA has added it to its KEV (Known Exploited Vulnerabilities) catalog, requiring U.S. federal agencies to apply the patch before August 25, 2026. According to Check Point Research, the Lazarus group (linked to North Korea) used it in its Operation Dream Job campaign.
  • CVE-2026-72971 (CVSS 5.5) — spoofing vulnerability in the Windows Container Isolation FS Filter Driver (unionfs.sys), publicly disclosed.

Key takeaways

ShieldBreak serves as a reminder that fixing a vulnerability does not mean it has been eliminated. The fact that a defense-in-depth patch can be bypassed so quickly — with a 100% success rate on the latest versions of Windows — raises questions about the robustness of the protective mechanisms built into Microsoft Defender, which is itself a security product meant to protect users.

For organizations, immediate recommendations are:

  1. Monitor Microsoft communications regarding a potential patch for ShieldBreak, which was not part of the August Patch Tuesday.
  2. Keep Defender enabled, despite the vulnerability — disabling it would remove ShieldBreak's attack surface but expose the machine to many other threats.
  3. Strengthen access controls and the principle of least privilege, knowing that the exploit requires initial access to the machine (local privilege escalation, not remote access).
  4. Quickly apply the patches from the August Patch Tuesday, especially CVE-2026-68820, which is actively being exploited.

The Nightmare Eclipse vs. Microsoft case, with its eight zero-days published over four months and its backdrop of legal threats, represents one of the most tumultuous episodes in security research this year. ShieldBreak is the latest chapter, and likely not the last.