ShieldBreak bypasses Microsoft Defender patch: fully patched Win11 still yields SYSTEM in one shot
On 12 August, researcher Nightmare Eclipse published the ShieldBreak PoC on Microsoft's August Patch Tuesday, claiming a full bypass of the July patch for CVE-2026-50656 RoguePlanet. Fully patched Win11 and Win2025 yield SYSTEM at 100% success. No official patch yet.
Incident overview
ShieldBreak is a Microsoft Defender LPE proof-of-concept chain published by researcher Nightmare Eclipse (aka Chaotic Eclipse, INFINITE NIGHTMARE) on the night of 12 August 2026—Microsoft's August Patch Tuesday. The researcher describes it as a full bypass of the July CVE-2026-50656 RoguePlanet patch: any low-privilege Windows user on fully patched Windows 11 25H2 and Windows Server 2025 gets NT AUTHORITY\SYSTEM at 100% success. Tharros Labs principal vuln analyst Will Dormann and researcher Kevin Beaumont independently reproduced it on current Win11, but both note the technical path differs from RoguePlanet—not a pure patch bypass.
Technical details
Primary difference vs RoguePlanet is the surface. RoguePlanet raced the filesystem to manipulate Defender's quarantine path. ShieldBreak hooks the user-mode callback while Defender runs a cloud-hydration scan via Cloud Filter API (cfapi), swaps file contents, then chains Object Manager symlinks, Common Log File System (CLFS), and a Windows Error Reporting scheduled task to load attacker-controlled phoneinfo.dll. Microsoft Defender must be enabled—that's a prerequisite. Dormann's execution sequence:
- Register a temp directory as a Cloud Sync Provider and plant an EICAR file.
- Redirect Defender's scan path into System32 via Object Manager symlinks.
- During the scan, use CLFS to swap the identity file and hydration data for
C:\Windows\system32\phoneinfo.dll(absent by default). - Trigger the QueueReporting scheduled task (Run with highest privileges); execute
wermgr.exe -upload. - wer.dll loads phoneinfo.dll on its search path and spawns conhost.exe as SYSTEM.
August Patch Tuesday fixed 421 distinct CVEs but shipped no ShieldBreak patch. A Microsoft spokesperson told SecurityWeek and The Hacker News the company is aware of the reports, is investigating effectiveness and applicable scenarios, and restated support for coordinated disclosure.
Impact
Three practical points: (1) fully patched Win11/Win2025 with default Microsoft Defender worldwide is in scope; (2) the public PoC is immediately reusable by mid-skill operators as ransomware / spear-phish stage-two; (3) the researcher is explicit that Defender must be on, so third-party EDR replacements are not on this path. Beaumont and Dormann have posted actionable detection queries on Mastodon and elsewhere.
Further notes
Since April 2026 the same researcher has shipped BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, LegacyHive, RoguePlanet, and more—roughly a ten-pack of public Windows-related 0-day drops in the same window. Trade press frames it as scorched-earth against Microsoft's coordinated-disclosure process. Arctic Wolf nicknamed CVE-2026-50656 RoguePlanet at disclosure and treated engine version 1.1.26060.3008 (July) as the then-current patch marker. ShieldBreak shows that patch covered symptoms, not the root mechanism. Takeaway for defenders: an official high-severity Microsoft Defender patch is not a one-shot close. Check whether the patch hits root cause, and detect reused surfaces such as cfapi.
Mitigation and detection
- Track MSRC and Arctic Wolf CVE-2026-50656 status pages. Deploy the patch as soon as it ships.
- On every host with Microsoft Defender enabled, monitor Cloud Filter API (cfapi) callbacks. Alert on cfapi callbacks from non-Microsoft processes.
- In EDR, hunt System32/phoneinfo.dll existence or load. Isolate the host immediately if found.
- Segment local logon for high-value users. Restrict LUA and admin-session reuse.
- Tighten initial-access loaders from web/email so ShieldBreak's stage-two prerequisites are not met.
Sources
- The Hacker News: ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access
- SecurityWeek: Nightmare Eclipse Drops Windows Zero-Day Exploit ShieldBreak
- Cloud Security Alliance: ShieldBreak – A Full Bypass of Microsofts Defender Patch
- Uganda CERT: Microsoft Defender ShieldBreak Zero-Day Bypasses August Patch Tuesday Fix