A Researcher’s Third Straight Bypass Shows Microsoft’s Defender Patches Keep Falling Short

A security researcher who publishes under the name Nightmare Eclipse has released a third consecutive proof-of-concept exploit for the same underlying Microsoft Defender privilege-escalation bug, defeating a patch Microsoft shipped less than a week earlier. The new exploit, dubbed ShieldCrash, appeared within a day of Microsoft’s record-setting September 2026 Patch Tuesday and demonstrates that a flaw Microsoft has now tried to close twice can still be triggered on fully patched systems.

A patch, a bypass, and a bypass of the bypass

The chain starts with RoguePlanet, a race-condition bug in the Microsoft Malware Protection Engine, the scanning engine at the core of Microsoft Defender. Nightmare Eclipse disclosed RoguePlanet in June 2026, tracked as CVE-2026-50656, and Microsoft patched it on July 19.

The fix did not hold. In August, the researcher released ShieldBreak (CVE-2026-69414), described as a bypass that reached the same underlying elevation-of-privilege condition through a different path. Microsoft acknowledged ShieldBreak on August 14 and shipped a fix for it on Thursday, September 3, five days before this week’s Patch Tuesday.

ShieldCrash, published the following week, bypasses that fix too. “Microsoft has failed to properly patch ShieldBreak CVE-2026-69414, under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak,” Nightmare Eclipse wrote in the proof-of-concept’s release notes, according to BleepingComputer. “While Microsoft fixed several things to prevent re-exploiting the issue, they missed a spot where ShieldBreak can still be exploited.”

Both CVE-2026-50656 and CVE-2026-69414 carry Microsoft’s own CVSS 3.1 score of 7.8 (high severity), require only local, low-privileged access with no user interaction, and are scored for total impact to confidentiality, integrity, and availability once triggered. NVD’s own independent scoring puts RoguePlanet slightly lower, at 7.0, judging the attack complexity higher than Microsoft does. Neither bug is remotely exploitable over the internet on its own; an attacker needs some existing foothold on the machine first, which is exactly the kind of access ransomware operators and other intruders typically already have by the time they go looking to escalate privileges.

What the proof of concept does, and does not, do

According to Nightmare Eclipse, the published proof-of-concept demonstrates an arbitrary file read at SYSTEM level, the highest privilege on a Windows machine, on fully patched Windows 10, Windows 11, and Windows Server systems. BleepingComputer reported that the code as released does not grant write access. SecurityWeek separately reported the researcher’s claim that the underlying flaw can be pushed further, to full SYSTEM privileges capable of pulling the SAM database, the local file where Windows stores hashed account credentials, off a system that would normally block that kind of access. Nightmare Eclipse was clear that the public release is a minimal version: “This PoC demonstrates an arbitrary file read as SYSTEM with September 2026, all supported windows versions are affected. I might rework this later into a full SYSTEM PoC but for now I’m dropping this skeleton PoC because I’m feeling a bit lazy.”

SecurityWeek and BleepingComputer both reached out to Microsoft for comment and had not received a response as of publication. ShieldCrash has not been assigned its own CVE identifier, and no patch exists yet.

A pattern with a track record

Ensar Seker, CISO at threat-intelligence firm SOCRadar, told SecurityWeek that the repeated bypasses point to a deeper problem than any single patch can fix. “When researchers can bypass successive fixes for RoguePlanet and ShieldBreak, it suggests the underlying security boundary or attack surface may require a more comprehensive redesign rather than another narrowly targeted patch,” Seker said, adding that Microsoft “should also assess the complete vulnerability class and related code paths, not only the specific condition demonstrated by this latest proof of concept.” He recommended that security teams watch Microsoft’s guidance and Defender intelligence updates, enable tamper protection, restrict local administrative access, and monitor for unusual process behavior tied to Defender components.

ShieldCrash is one entry in a much longer list. Since April, Nightmare Eclipse, who has also used the handles Chaotic Eclipse, Infinite Nightmare, and MSNightmare, has disclosed proof-of-concept zero-days under the codenames ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend, targeting Microsoft Defender, BitLocker, and other Windows components, according to BleepingComputer’s count. Microsoft has shipped official fixes for ShieldBreak, RoguePlanet, YellowKey, GreenPlasma, and MiniPlasma; the remaining bugs, including LegacyHive, BlueHammer, RedSun, and UnDefend, still have no official patch. One of them, BlueHammer, was later flagged by CISA as a Defender flaw seen in ransomware campaigns, sxz.io reported in June, evidence that this researcher’s proof-of-concept code does not always stay theoretical once it is public.

The disclosures have not stayed confined to Microsoft, either. In the two weeks before ShieldCrash, Nightmare Eclipse released zero-day exploits targeting Kaspersky’s endpoint antivirus, CrowdStrike’s Falcon sensor, Nvidia’s GPU drivers, and GenDigital’s Avast antivirus, a spree sxz.io covered in detail on September 7. By that point Kaspersky and GenDigital had already shipped fixes; CrowdStrike and Nvidia had not. BleepingComputer reported that the researcher has framed the Microsoft disclosures as part of an ongoing dispute over the company’s bug bounty and vulnerability disclosure practices, and that Microsoft has previously warned of legal action over “malicious activity causing real harm” to its customers, language BleepingComputer said many read as a direct threat aimed at the researcher.

What to do now

sxz.io covered Microsoft’s largest Patch Tuesday on record earlier this week; ShieldCrash is a reminder that a record-setting patch cycle does not mean a clean slate for every product it touched. Because ShieldCrash has no CVE number yet, it will not surface in a routine vulnerability scan or a patch-management dashboard search built around CVE identifiers. Windows administrators should instead track this by vendor advisory: confirm the September 3 fix for CVE-2026-69414 has been deployed, treat that fix as necessary but no longer sufficient on its own, and follow Seker’s advice to enable Defender tamper protection, tighten local administrative access, and watch for anomalous behavior around Defender-related processes rather than waiting on a CVE number to organize a response.