Security researcher Nightmare Eclipse has dropped a fresh zero-day exploit leading to privilege escalation on Windows.
Also known as Chaotic Eclipse, the disgruntled researcher released multiple zero-day exploits targeting Microsoft products over the past several months, usually right after the Patch Tuesday security updates.
Right on cue, the new proof-of-concept (PoC) exploit, dubbed ShieldBreak, was published on August 2026 Patch Tuesday. It targets a vulnerability in Microsoft Defender, allowing any user to gain System privileges.
According to Nightmare Eclipse, the exploit is a RoguePlanet patch bypass, works on the latest Windows 11 versions and on Windows Server 2025, and likely impacts Windows 10 machines as well.
Tracked as CVE-2026-50656, RoguePlanet is a race condition flaw in Defender that Nightmare Eclipse dropped as a zero-day on June 9. Microsoft acknowledged the exploit on June 16 and released fixes for it on July 9.
Per the analysis of Tharros Labs’s Will Dormann, ShieldBreak involves setting up a temporary directory registered as a Cloud Sync provider, planting an EICAR file, controlling Defender’s scan path to System32, using Windows’ CLFS to swap the identity file and hydration data to a ‘phoneinfo.dll’ file in System32, then running the QueueReporting scheduled task.
“In the wer.dll code, there is explicit code to load phoneinfo.dll [which does not exist by default in Windows]. Because at this point, phoneinfo.dll exists and is our own code, this runs, spawning conhost.exe with SYSTEM privileges,” Dormann says.
Both Dormann and cybersecurity expert Kevin Beaumont, who published detection queries for the fresh PoC, disagree with Nightmare Eclipse’s assertion that ShieldBreak is a RoguePlanet bypass, as they work differently.
“RoguePlanet was a filesystem race condition vuln that uses virtual disks and NT native file manipulation to trick the quarantine process into overwriting system files. ShieldBreak user-mode callback hook to change file contents during a Defender cloud-hydration scan via cfapi (Cloud Filter API),” Beaumont said.
Dormann also points out that “ShieldBreak seems to require Defender to be active to work,” while RoguePlanet did not.
Responding to a SecurityWeek inquiry, a Microsoft spokesperson provided the following statement:
“Microsoft is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims. Microsoft is committed to investigating security issues and updating impacted products to protect customers as soon as possible. Importantly, we support coordinated vulnerability disclosure, an industry standard that protects customers and supports the research community by ensuring their findings are thoroughly investigated and addressed before being made public.
*Updated with statement from Microsoft.
Related: SharePoint Vulnerability Exploited Shortly After PoC Release
Related: Chipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities Combined
Related: Fresh Windows Zero-Day Exploited in North Korean Cyberattacks
Related: Ivanti EPM Update Patches Remotely Exploitable Flaws
