CVE-2026-50656Patch(microsoft / malware_protection_engine)

Microsoft has failed to properly patch RoguePlanet (CVE-2026-50656), ShieldBreak, a PoC that demonstrates a full bypass to the previous patch is now public. https://github.com/MSNightmare/ShieldBreak The PoC works with the latest August 2026 patch

‼️ Microsoft's July patch for the RoguePlanet local privilege escalation Defender flaw (CVE-2026-50656) has been bypassed. Nightmare Eclipse published exploit code called ShieldBreak on GitHub, hours after August Patch Tuesday. The researcher claims a 100% success rate on fully patched Windows 11 25H2 and Server 2025, where RoguePlanet's race condition was hit-or-miss. The vulnerability makes it possible for any local user to get SYSTEM. No fix yet.

🚨Nightmare Eclipse has released a new zero-day PoC called ShieldBreak Per the security researcher: "Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass." GitHub: https://github.com/MSNightmare/ShieldBreak https://t.co/TguW17Negh

Microsoft issued a security patch for RoguePlanet https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-50656

‼️ Microsoft patched RoguePlanet. Now the researcher has dropped another zero-day that claims to bypass the fix. ShieldBreak is said to fully bypass Defender’s CVE-2026-50656 patch. The underlying flaw can lead to SYSTEM-level privileges. Read more: https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html https://t.co/uyVTIrG2GG

🚨 Microsoft Defender zero-day RoguePlanet is now officially CVE-2026-50656. Microsoft is preparing a patch for the Malware Protection Engine flaw, which can enable privilege escalation. A public PoC describes a race condition that may grant SYSTEM-level privileges. Read: https://thehackernews.com/2026/06/microsoft-confirms-rogueplanet-defender_02022423645.html

🔴 SON DAKİKA !!! Siber güvenlik araştırmacısı Nightmare-Eclipse (MSNightmare / INFINITE NIGHTMARE), Microsoft'un RoguePlanet (CVE-2026-50656) açığı için düzgün bir yama yayınlayamadığını belirterek, önceki yamayı tamamen bypass eden "ShieldBreak" adlı herkese açık bir PoC paylaştı. PoC, iddiaya göre Ağustos 2026 Windows güncellemeleri yüklüyken bile çalışıyor. PoC: https://github.com/MSNightmare/ShieldBreak

⚡ Microsoft patched RoguePlanet weeks after the Defender flaw was publicly disclosed. CVE-2026-50656 affects the #Microsoft Malware Protection Engine and could let local attackers gain SYSTEM-level privileges, according to the researcher who disclosed it. Full story here → https://thehackernews.com/2026/07/microsoft-patches-rogueplanet-defender.html

تذكرون ثغره RoguePlanet في Microsoft Defender اللي تعطي المستخدم المحلي صلاحيات SYSTEM؟ 🚨 نشر Nightmare Eclipse PoC باسم ShieldBreak ويقول إنه يتجاوز إصلاح Microsoft لـ CVE-2026-50656 على Windows 11 وWindows Server 2025 يتبع 👇 https://t.co/Q6BLfEyQ2n

ShieldBreak Windows Defender 0day vulnerability Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass. Credit/Source: https://github.com/MSNightmare/ShieldBreak https://t.co/VJ6B8MeEqp

🚨 0-DAY ALERT: "ShieldCrash" hits Microsoft Defender Security, researcher Nightmare Eclipse dropped a new zero-day PoC bypassing Microsoft's Sept 2026 patches for ShieldBreak (CVE-2026-69414). The flaw turns Defender's privileged operations against itself, enabling arbitrary file reads as NT AUTHORITY\SYSTEM (and potential SAM dumping / full LPE). Here is what you need to know, how to hunt for it, and actionable mitigations 🧵👇 What is the Breach / Vulnerability? Origin: Direct patch bypass for ShieldBreak (CVE-2026-69414), which itself was a bypass for RoguePlanet (CVE-2026-50656). Mechanism: Exploits a race condition in the Microsoft Malware Protection Engine (MpEngine) during file hydration and scanning via the Windows Cloud Filter API (cfapi.dll) and Object Manager symbolic link manipulation (\BaseNamedObjects\Restricted\). Impact: A local, low-privileged attacker forces Defender to execute privileged file operations on attacker-controlled paths, resulting in arbitrary file reads with SYSTEM access (including the SAM hive) and escalation paths. Scope: Affects all supported Windows 10, Windows 11 (including 25H2), and Windows Server releases running current September builds. How to Detect Compromise 1. File & Directory Artifacts (Default PoC behavior): Look for staging paths created under the system drive: C:\ShieldBreak_* or C:\ShieldCrash_* Creation of temporary sync-root providers registered via CfRegisterSyncRoot (default PoC name: Flubber). 2. Event Log & Process Telemetry: Event ID 1116 / 1117 (Defender Operational Logs): Sudden bursts of EICAR test file detections immediately followed by cleanup failures or locked file warnings. Named Pipe creation: Telemetry spotting pipe names matching \\.\pipe\SHIELDBREAK* or \\.\pipe\SHIELDCRASH*. Object Manager & Symlink Anomalies: Creation of symbolic links pointing from \BaseNamedObjects\ to protected system locations (C:\Windows\System32\...) or UNC loopback shares (\\127.0.0.1\C$). Abnormal System Reads: Low-privileged user processes causing MsMpEng.exe or system background tasks to interact with C:\Windows\System32\config\SAM or SYSTEM hives. Immediate Mitigations Because this is an active zero-day bypass without a vendor-confirmed engine hotfix, apply defense-in-depth controls: Enable Tamper Protection & Cloud-Delivered Protection: Ensure Microsoft Defender Antivirus cloud lookups and Tamper Protection are enforced across all endpoints via Intune/GPO. Restrict Local Administrative & Execution Footprints: Ensure users do not possess unnecessary local rights, and enforce Application Control (WDAC / AppLocker) to prevent running unapproved staging binaries or scripts. Attack Surface Reduction (ASR) Rules: Block executable files from running unless they meet a prevalence, age, or trusted list criterion. Block process creations originating from PSExec, WMI, or Task Scheduler executing untrusted binaries. Endpoint Isolation: If an endpoint flags suspicious Defender race condition attempts or anomalous SAM registry access, isolate the host immediately for forensic capture. Indicators of Compromise (IoCs) Named Pipes: \\.\pipe\SHIELDBREAK, \\.\pipe\SHIELDCRASH Staging Paths: C:\ShieldBreak_*\, C:\ShieldCrash_*\ Observed Bait / Dropper Artifacts: Warden.dll, BERLIN (placeholder), embedded http://eicar.com resources Suspicious Loopback Calls: Target paths invoking \\127.0.0.1\C$\ paired with Alternate Data Streams (:stream) #ShieldCrash #MicrosoftDefender #ZeroDay #CyberSecurity #InfoSec #ThreatIntel #BlueTeam #SOC #PatchTuesday #ThreatHunting #LPE #YARA #IncidentResponse

‼️⚠️ DEFENDER CRACKÉ : Zero-Day RoguePlanet donne les clés SYSTEM ! Microsoft confirme un zero-day dans Windows Defender (CVE-2026-50656) Race condition 👉 privilèges SYSTEM. L’exploit est public Le patch n’est pas encore sorti Des millions de machines exposées en ce moment L’antivirus officiel se fait démonter de l’intérieur ! Vérifiez les mises à jour 👀

مایکروسافت یک آسیب‌پذیری روز صفر در Microsoft Defender با نام RoguePlanet رو برطرف کرده که می‌تونست به مهاجم اجازه بده تا با سوءاستفاده از یک نقص Race Condition، سطح دسترسی خودش رو تا SYSTEM بالا ببره. این مشکل با شناسه CVE-2026-50656 ثبت شده بود و حتی روی ویندوز ۱۰ و ۱۱ کاملاً آپدیت‌شده هم قابل سوءاستفاده بود. © bleepingcomputer

🚨 Microsoft solucionó la vulnerabilidad en Microsoft Defender CVE-2026-50656 (RoguePlanet), una falla de elevación de privilegios en el Malware Protection Engine. Vulnerabilidad descubierta por el "famoso" NightmareEclipse. Aún sigue la guerra 😬 https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-50656

The irony of a flaw in your defense tools. 🚨 #RoguePlanet (CVE-2026-50656) gives attackers LPE to SYSTEM via Microsoft Defender's core engine. The patch is live, but public PoC code is already in the wild. Update to engine 1.1.26060.3008+ immediately to mitigate the risk and strengthen your posture. 🔍 Read more: https://hubs.la/Q04p12Ch0 #CyberSecurity #MicrosoftDefender #InfoSec

It seems MS will address this now as CVE-2026-50656 with release for tomorrow but their API already exposes it? https://patchapalooza.com/cve/CVE-2026-50656 https://t.co/5w6bhlMyAe

MSNightmare's ShieldBreak PoC claims to fully bypass Microsoft's July patch for CVE-2026-50656, achieving SYSTEM-level privileges on Windows 11 and Server 2025. #ShieldBreak #CVE202650656 #MicrosoftDefender #PrivilegeEscalation #Windows11 https://meterpreter.org/shieldbreak-cve-2026-50656-defender-bypass/

【また君か】SYSTEM取得可能なMicrosoft Defenderのゼロデイ脆弱性"ShieldBreak"が開示された。いつものNightmare Eclipse案件。"RoguePlanet" (CVE-2026-50656)の修正回避。完全パッチ適用済みでも刺さる。【壊れるなぁ】

The PoC demonstrates a complete patch bypass for CVE-2026-50656 (RoguePlanet). It affects Windows 11 25H2 and Server 2025 with a 100% success rate. 😎 https://github.com/MSNightmare/ShieldBreak

ثغرة Zero-Day في Microsoft Defender تسمح برفع الصلاحيات والسيطرة على أنظمة Windows المحدثة. الثغرة RoguePlanet، اكتشفها الباحث @ChaoticEclipse0، مع PoC من 10 يونيو. اعترفت @Microsoft بالثغرة (CVE-2026-50656)، وتعمل على تصحيح. سبق للباحث نفسه كشف ثغرات سابقة عالجتها الشركة. https://t.co/M7itvZQ8do