A third bypass of the same Defender flaw landed hours after Microsoft's second fix shipped

The EICAR archive in the proof-of-concept is the most informative file in it. EICAR is the standard malware detection test string, and dev.to says its presence shows the exploitation path runs through Defender's scanning pipeline ^[15][16]. Defender scans with SYSTEM privileges. Per dev.to's description, an attacker who gets Defender to process the right file can make it open a protected system file and hand back the contents. The result is an arbitrary file read as SYSTEM on every supported version of Windows ^[17].

That shape is why two fixes have not held. The original flaw, RoguePlanet, sat in Defender's file-handling workflow, and Microsoft patched it in July ^[11]. ShieldBreak showed the patch was incomplete, so Microsoft assigned CVE-2026-69414 at CVSS 7.8 and shipped a second fix in Malware Protection Engine version 1.1.26080.3 ^[12]. Nightmare Eclipse was specific about that second fix: "Microsoft has failed to properly patch ShieldBreak CVE-2026-69414. Under specific conditions it is still possible to trigger the exact same problem," the researcher said ^[14]. In my view the second fix narrowed the conditions under which Defender can be steered and left the privilege boundary where it was.

The same researcher has disclosed nine zero-days in Defender, BitLocker and Windows components since April 2026, and Microsoft answered the earlier ones with warnings of legal action against researchers causing "malicious activity causing real harm" ^[19].

The headline count is harder to pin down than it looks. dev.to counts 972 CVEs, of which 258 are remote code execution and 437 elevation of privilege ^[1][3]. InfoQ describes the same release as addressing more than 950 vulnerabilities and cites BleepingComputer's classification at 258 remote code execution and 438 elevation of privilege ^[5][4]. The product-family split does not reconcile either: 726 patches for Windows, 135 for Office and 650 under Extended Security Update programs ^[7] sum to 1,511 against a 972 total ^[2].

For sizing the work, the subsets are the usable part. Those 650 ESU patches apply only to an estate that still has ESU-covered machines in it ^[7]. Of the release, 113 are rated Critical ^[2], and 20 are wormable, meaning remote unauthenticated code execution with no user interaction required ^[10]. InfoQ puts Microsoft's 2026 running total at about 2,750 CVEs, more than double the previous annual record of about 1,250 in 2020 ^[6]. September alone is roughly 35% of that year-to-date figure ^[1].

Both actively exploited zero-days came in at CVSS 7.8: CVE-2026-85880, a heap buffer overflow in Windows ALPC that lifts sandboxed local code to SYSTEM, and CVE-2026-81963, an improper link resolution bug in the Windows Update Stack ^[8]. Volexity and Proofpoint found the first; Airbus Helicopters and the Microsoft Threat Intelligence Center independently reported the second ^[9]. The fix for a privilege escalation bug in the update stack is delivered by the update stack.

Marva Bailer, founding CEO at Qualaix, said that "finding the problem is one step. Organizations still have to understand their exposure, test the patch, determine what else it might affect and then deploy it across potentially thousands of devices and interconnected systems" ^[22]. On the Defender chain the deploy step is already done, and dev.to's assessment is that a fully patched system running the latest engine is still open to arbitrary file reads as SYSTEM, with Microsoft aware of the underlying issue class since June ^[20]. Tyler Reguly, security R&D associate director at Fortra, said that "as long as Microsoft is playing catch-up on patching vulnerabilities, numbers have lost all meaning" ^[21].