CVE-2026-50656

Microsoft Defender Zero-Day ShieldBreak Enables SYSTEM Privilege Escalation, Bypassing July Rogue Planet Patch

Security researcher Nightmare Eclipse has publicly disclosed a new zero-day vulnerability named ShieldBreak in Microsoft Defender that allows any standard Windows account to escalate privileges directly to SYSTEM level. The flaw exploits a TOCTOU race condition in Defender's file scanning API callbacks, enabling attackers to swap file contents during the brief window when the scanner reads the file. Although linked to the earlier Rogue Planet vulnerability (CVE-2026-50656), the July patch did not fully address the attack surface, and an adjusted proof-of-concept continues to work on patched systems. Defender's high privileges and trusted status in enterprise environments amplify the risk, as compromised processes can execute malicious actions that appear legitimate in logs. Public disclosure without prior private reporting leaves a window of exposure until Microsoft issues an official fix. Blue teams are advised to enforce strict local permissions, monitor for anomalous Defender process behavior such as unusual child processes or repeated file handle operations, and implement layered defenses including application whitelisting and network segmentation.

Windows Defender Patch for RoguePlanet Zero-Day Vulnerability May Exhaust Disk Space on Windows Systems

Microsoft released a security update addressing the RoguePlanet zero-day vulnerability (CVE-2026-50656) in the Microsoft Malware Protection Engine used by Windows Defender. The flaw, disclosed earlier by researcher NightmareEclipse, allowed remote attackers to gain administrative control over Windows 10 and Windows 11 even when real-time protection was disabled. While the patch was intended to resolve the issue and deploy automatically, the researcher now claims it introduces a new problem involving excessive disk writes. Specifically, the update may cause Defender to cache extremely large Zone.Identifier alternate data streams without size limits, potentially filling the entire drive. The attack vector involves a malicious SMB server that serves oversized metadata streams while maintaining the connection. Microsoft has not yet confirmed the reported behavior, and tensions between the company and the researcher continue over disclosure practices and bug bounty rewards.