ShieldCrash bypasses Microsoft's second patch in the same Defender escalation chain
Nightmare Eclipse, who dropped RoguePlanet in June and ShieldBreak in August, has published proof-of-concept code that reads any file with System privileges on fully patched Windows, inside the same month as Microsoft's September 3 fix.
The Watch · Security desk
What happened
- The researcher Nightmare Eclipse published ShieldCrash, a Microsoft Defender privilege-escalation zero-day exploit that works on fully patched Windows, right after Microsoft's September 2026 patches.
- ShieldBreak had itself bypassed Microsoft's July 19 patch for RoguePlanet, CVE-2026-50656, a race condition dropped as a zero-day on June 2026 Patch Tuesday.
- Microsoft had not commented at publication; SecurityWeek said it emailed the company for a statement on the new exploit.
Why it matters
- Who's exposed exposure Any commodity foothold on a fully patched Windows host regains a System-level file read step that the September 3 fix was supposed to have taken away.
- Who has to decide decision With no CVE for ShieldCrash and no vendor statement, teams cannot key their response to a patch entry, so the choice is between restricting local execution now and accepting that a foothold escalates.
- What doesn't add up contradiction The SAM dump rests on the researcher's word while the file read is demonstrated in public code, and rating the demonstrated primitive rather than the claimed one is what keeps the priority honest.
- What it sets up precedent Two shipped Microsoft fixes in this chain have been broken publicly within a month each, so a plan that assumes the third holds is planning against the record of the first two.
RoguePlanet, the June zero-day at the root of this, was a race condition [6]. Nightmare Eclipse's claim about ShieldCrash is that the old bug was never closed: Microsoft's ShieldBreak fixes are incomplete, the defect is still exploitable, and ShieldCrash is the demonstration [21]. SecurityWeek says it asked Microsoft for comment and had nothing back at publication [8].
Three exploit releases: RoguePlanet on June 2026 Patch Tuesday [6], ShieldBreak on August 2026 Patch Tuesday [20], ShieldCrash right after the September batch [1]. Two Microsoft fixes: July 19 for CVE-2026-50656 [7], September 3 for CVE-2026-69414 [4]. ShieldCrash is the second public bypass of a shipped Microsoft fix here. It is also the third exploit in the sequence [14]. Neither fix lasted a month in public [16].
Microsoft went from acknowledging ShieldBreak on August 14 to shipping on September 3, twenty days [4][13]. The bypass was public inside the same calendar month as that fix [15]. ShieldCrash itself carries no CVE in SecurityWeek's account, unlike the two links before it [17].
What is public is an arbitrary file read running with System privileges [18]. Full System and dropping the SAM database are what the researcher says the underlying bug supports, not what the released code shows [19]. Either version is local privilege escalation, so it needs a foothold first; it prices the second half of an intrusion, not the way in. SecurityWeek's report describes no observed exploitation in the wild [12].
The handle is part of the read. Nightmare Eclipse, also tracked as Chaotic Eclipse, Infinite Nightmare and MSNightmare [3], has previously published zero-day exploits for CrowdStrike, Nvidia and Avast, according to SecurityWeek [5]. That is a researcher who returns to security-product attack surface on a schedule, which is the difference between one exploit and a supply.
SOCRadar CISO Ensar Seker reads the successive bypasses as a sign the security boundary or attack surface may need a comprehensive redesign rather than another narrowly targeted patch, and says Microsoft should assess the whole vulnerability class and related code paths, not only the condition this proof of concept demonstrates [9][11]. His interim list (tamper protection enabled, admin access and local execution paths restricted, Defender-related process behavior watched) leaves the primitive in place [10]. It narrows who can reach it and improves the odds you see the attempt. The bar for Microsoft's third fix was set by the first two: twenty days to ship, under a month to break [13][16].
What to watch
- A CVE assignment or out-of-band advisory for ShieldCrash, which would show whether Microsoft treats it as a distinct defect or a reopened one.
- Any Microsoft response that addresses the vulnerability class and surrounding code paths rather than the single condition in the proof of concept.
- First report of in-the-wild use of the System-level file read, which moves this from a published primitive to incident work.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+45
- Incentives60
- Confidence50
Perspective Coverage
17 publishers- Builder
- Builder 9%
- Operator
- Operator 82%
- Investor
- Investor 9%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The researcher known as Nightmare Eclipse released a Microsoft Defender zero-day exploit dubbed ShieldCrash right after Microsoft's record-breaking September 2026 patches.
- [2]
ShieldCrash targets fully patched Windows systems for privilege escalation.
- [3]
Nightmare Eclipse is also known as Chaotic Eclipse, Infinite Nightmare and MSNightmare.
- [4]
Microsoft acknowledged ShieldBreak on August 14 and rolled out fixes for it on September 3; the bug is tracked as CVE-2026-69414.
- [5]
SecurityWeek has previously reported that the same researcher dropped CrowdStrike, Nvidia and Avast zero-day exploits.
- [6]
ShieldBreak was released as a bypass for Microsoft's patches against RoguePlanet, a race condition bug dropped as a zero-day on June 2026 Patch Tuesday.
- [7]
Microsoft patched RoguePlanet, tracked as CVE-2026-50656, on July 19.
- [8]
SecurityWeek emailed Microsoft for a statement on the exploit and said it would update the article if the company responds.
- [9]
SOCRadar CISO Ensar Seker said that when researchers can bypass successive fixes for RoguePlanet and ShieldBreak, it suggests the underlying security boundary or attack surface may require a more comprehensive redesign rather than another narrowly targeted patch.
- [10]
Seker advises security teams to monitor Microsoft's guidance and Defender intelligence updates, enable tamper protections, restrict admin access and local execution paths, and look for suspicious process behavior associated with Defender-related mechanisms.
- [11]
Seker said Microsoft should assess the complete vulnerability class and related code paths, not only the specific condition demonstrated by the latest proof of concept.
- [12]
SecurityWeek's report on ShieldCrash contains no mention of observed exploitation in the wild.
- [13]
Twenty days elapsed between Microsoft acknowledging ShieldBreak on August 14 and shipping fixes on September 3.
- [14]
The sequence contains three public exploit releases (RoguePlanet, ShieldBreak, ShieldCrash) and two Microsoft fixes (July 19, September 3), making ShieldCrash the second public bypass of a shipped Microsoft fix in the chain rather than the third.
- [15]
Microsoft's September 3 fix for CVE-2026-69414 was publicly bypassed within the same calendar month, since ShieldCrash was released right after the September 2026 patch batch.
- [16]
Both Microsoft fixes in this chain were publicly bypassed less than a month after shipping: the July 19 fix was bypassed at August 2026 Patch Tuesday, which falls no later than the 14th, and the September 3 fix was bypassed just after the September 2026 patches.
- [17]
ShieldCrash has no CVE identifier in SecurityWeek's report, while the two earlier links in the chain do (CVE-2026-50656 and CVE-2026-69414).
- [18]
The proof-of-concept exploit code demonstrates an arbitrary file read with System privileges, according to Nightmare Eclipse.
- [19]
The researcher says the underlying vulnerability can be exploited to gain full System privileges, allowing attackers to drop the SAM database.
- [20]
Nightmare Eclipse says ShieldCrash is a bypass for ShieldBreak, the Microsoft Defender privilege escalation exploit dropped on August 2026 Patch Tuesday.
- [21]
Nightmare Eclipse says Microsoft's patches for ShieldBreak are incomplete and the security defect can still be exploited, releasing ShieldCrash as proof.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
17 independent publishers whose own reporting we read for this story.
- ShieldCrash exploit claims Microsoft Defender bypass
betanews.com
1 article · September 11, 2026
- bleepingcomputer.comMicrosoft releases Windows 10 KB5122878 extended security update
1 article · September 8, 2026
- blog.talosintelligence.comMicrosoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
1 article · September 8, 2026
- crowdstrike.comSeptember 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs
1 article
- cyberdaily.auOp-Ed: Microsoft September Patch Tuesday reveals 999 vulnerabilities - Cyber Daily
1 article · September 8, 2026
- cyberscoop.comMicrosoft discloses two actively exploited zero-days among 974 vulnerabilities
2 articles · September 8, 2026
- helpnetsecurity.comSeptember 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor
2 articles · September 9, 2026
- infosecurity-magazine.comMicrosoft Shatters Patch Tuesday Record With 974 CVE Fixes in September 2026
2 articles · September 9, 2026
- Security Alert: Microsoft Releases September 2026 Security Updates
jpcert.or.jp
1 article · September 8, 2026
- krebsonsecurity.comMicrosoft Plugs Nearly 1,000 Security Holes
2 articles · September 8, 2026
- malwarebytes.comMicrosoft fixes record 964 flaws, including 2 exploited zero-days
1 article · September 9, 2026
- scworld.comWhat Microsoft’s largest Patch Tuesday update means to security teams
2 articles · September 10, 2026
- securityaffairs.comMicrosoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs
2 articles · September 9, 2026
- securityweek.comMicrosoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days
4 articles · September 11, 2026
- thecyberexpress.comMicrosoft Patch Tuesday Hits Record 974 CVEs, Two Exploited
2 articles · September 9, 2026
- thehackernews.comMicrosoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
4 articles · September 9, 2026
- therecord.mediaMicrosoft posts nearly 1,000 bugs for Patch Tuesday as CISA warns two being exploited
1 article · September 8, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Vulnerability DisclosureFollow
- Windows Privilege EscalationFollow
- Patch bypassFollow
- Patch TuesdayFollow
Entities
- MicrosoftFollow
- CVE-2026-69414Follow
- Ensar SekerFollow
- Microsoft DefenderFollow
- CVE-2026-50656Follow
- Nightmare EclipseFollow
- Microsoft Malware Protection EngineFollow
- ShieldCrashFollow