> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Microsoft-vendetta hacker has a new zero day that gives system privileges on fully patched Windows - URL: https://f4n6.co.uk/security-feed/microsoft-vendetta-hacker-has-a-new-zero-day-that-gives-system-privileges-on-fully-patched-windows/ - Published: 2026-08-13T08:40:46.000Z - Updated: 2026-08-13T08:40:46.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-50656, CVE-2026-33825, CVE-2026-41091, CVE-2026-45498, CVE-2026-45585, Nightmare Eclipse ## 1\. Executive summary A threat actor using the alias "Nightmare Eclipse" (also known as Chaotic Eclipse, INFINITE NIGHTMARE, MSNightmare) has published a proof-of-concept (PoC) exploit dubbed "ShieldBreak," which grants `NT AUTHORITY\SYSTEM` privileges on fully patched Windows 10, Windows 11, and Windows Server systems. The exploit is a local privilege-escalation (LPE) vulnerability in Microsoft Defender that bypasses the patch for a prior flaw, CVE-2026-50656 (CVSS 7.8 HIGH, EPSS 11%, not in CISA KEV), which Microsoft addressed in July via the Microsoft Malware Protection Engine. Attribution to a specific individual is unconfirmed; the actor claims to be a former disgruntled Microsoft employee. EMEA financial services running Microsoft Defender on endpoints or servers face an elevated risk of complete system compromise by authenticated, low-privileged attackers until Microsoft releases a dedicated fix. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 24: digital operational resilience testing — general requirements | A zero-day LPE in core endpoint security tooling (Defender) requires immediate validation of detection and mitigation controls. | Firms must test the effectiveness of their current endpoint configurations and threat-hunting queries against the ShieldBreak mechanism. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | An unpatched LPE bypassing a recent critical fix (CVE-2026-50656) constitutes a high-severity cyber threat requiring formal classification. | Firms must classify the exposure of their Windows estate to ShieldBreak within their ICT incident management frameworks. | ## 3\. Technical analysis & attack chain ShieldBreak is a local privilege-escalation exploit targeting Microsoft Defender on fully patched Windows systems. It is the tenth zero-day released by the actor since April 2026\. The actor claims the PoC has a 100% success rate on Windows 11 25H2 (including Canary channel) and Windows Server 2025, noting that while Windows 10 and corresponding server editions are also vulnerable, they are not currently supported by the PoC code. The attack chain operates as follows: 1. **Initial Access & Positioning:** An attacker must possess an authenticated, low-privileged session on a target Windows system where Microsoft Defender's real-time protection is active. 2. **Exploit Execution:** The attacker executes the ShieldBreak PoC. The mechanism differs from the earlier RoguePlanet exploit. While RoguePlanet (CVE-2026-50656) was a filesystem race condition using virtual disks and NT native file manipulation to trick the quarantine process into overwriting system files, ShieldBreak operates by abusing the Cloud Filter API (cfapi). 3. **Mechanism:** ShieldBreak uses a user-mode callback hook to alter file contents during a Defender "cloud-hydration scan" via cfapi. 4. **Privilege Escalation:** The exploit successfully elevates the attacker's privileges from a standard user context to `NT AUTHORITY\SYSTEM`, granting complete control of the local machine. **Discrepancy Note:** The verified reference data classifies CVE-2026-50656 (the patched vulnerability ShieldBreak bypasses) under CWE-59 (Improper Link Resolution Before File Access). Source reporting corroborates this by describing the original RoguePlanet flaw as an improper link resolution/race condition in file handling. **Attribution Caveat:** Attribution to "Nightmare Eclipse" is based on the actor's own public claims. The actor has no MITRE ATT&CK profile in the verified reference data; treat attribution as unconfirmed. The claim that the actor is a former Microsoft employee is single-sourced from the actor's statements and should not be treated as verified intelligence. ## 4\. Mitigation & containment ### P1 — Within 24 hours: Threat Hunting & Detection - Deploy hunting queries published by researcher Kevin Beaumont to identify stealthy ShieldBreak execution in your environment. (Specific queries are referenced in The Register's reporting; obtain them from the source URL). - Audit systems running Windows 11 25H2 and Windows Server 2025 for unexpected `SYSTEM`\-level process spawning from standard user contexts, particularly those involving `MsMpEng.exe` or `cfapi.dll`. ### P2 — Within 72 hours: Endpoint Hardening & Validation - Verify that the Microsoft Malware Protection Engine is updated to version 1.1.26060.3008 or later. While this version patched the original RoguePlanet (CVE-2026-50656) flaw, it does not fix ShieldBreak; however, ensuring the engine is current prevents exploitation via the older vector. - If Defender is not the primary AV (e.g., a third-party AV is active and Defender is disabled), confirm that the Defender scanning engine is not running, as this mitigates the specific cfapi attack vector. ### P3 — Within 7 days: Process & Monitoring Updates - Monitor Microsoft security advisories for the release of a patch specifically addressing the ShieldBreak cfapi bypass mechanism. - Restrict interactive logon access for low-privileged service accounts on critical Windows Server 2025 assets where feasible, as the exploit requires local execution. ## 5\. Indicators of compromise No indicators of compromise available in the source material. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | --------------------------------------------------------------------------------------- | ------------------------------------------ | ---------- | | User-mode callback hooking of cfapi.dll during a Defender cloud-hydration scan | EDR / Endpoint process injection detection | High | | Standard user context spawning processes with NT AUTHORITY\\SYSTEM privileges | EDR / Windows Event Log (Event ID 4688) | High | | Unexpected file modifications occurring during Defender quarantine/hydration operations | EDR / File integrity monitoring | Medium | ## 6\. Detection Insufficient indicators to author detection rules. ## CVE assessment 7 referenced CVEs — **3 actively exploited (CISA KEV)** | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ---------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-33825](https://nvd.nist.gov/vuln/detail/CVE-2026-33825?ref=f4n6.co.uk) | 7.8 High | ⚠ KEV 2026-04-22 | 7% | Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally. | | [CVE-2026-41091](https://nvd.nist.gov/vuln/detail/CVE-2026-41091?ref=f4n6.co.uk) | 7.8 High | ⚠ KEV 2026-05-20 | 10% | Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate p… | | [CVE-2026-45498](https://nvd.nist.gov/vuln/detail/CVE-2026-45498?ref=f4n6.co.uk) | 4.0 Medium | ⚠ KEV 2026-05-20 | 63% | Microsoft Defender Denial of Service Vulnerability | | [CVE-2026-50656](https://nvd.nist.gov/vuln/detail/CVE-2026-50656?ref=f4n6.co.uk) | 7.8 High | — | 11% | Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly refer… | | [CVE-2026-45586](https://nvd.nist.gov/vuln/detail/CVE-2026-45586?ref=f4n6.co.uk) | 7.8 High | — | 4% | Improper link resolution before file access ('link following') in Windows Collaborative Translation Framework allows an authori… | | [CVE-2020-17103](https://nvd.nist.gov/vuln/detail/CVE-2020-17103?ref=f4n6.co.uk) | 7.0 High | — | 27% | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | | [CVE-2026-45585](https://nvd.nist.gov/vuln/detail/CVE-2026-45585?ref=f4n6.co.uk) | 6.8 Medium | — | 1% | Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The pro… | ## 7\. Sources - The Register — Microsoft-vendetta hacker has a new zero day that gives system privileges on fully patched Windows — https://www.theregister.com/security/2026/08/12/microsoft-vendetta-hacker-has-a-new-zero-day-that-gives-system-privileges-on-fully-patched-windows/5286889 — 2026-08-12 - The Hacker News — ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access — https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html — 2026-08-12 - The Register — Microsoft closes book on Nightmare Eclipse's RoguePlanet zero-day — https://www.theregister.com/security/2026/07/09/microsoft-closes-book-on-nightmare-eclipses-rogueplanet-zero-day/5269280 — 2026-07-09 - Help Net Security — Microsoft working on patch for RoguePlanet Defender zero-day (CVE-2026-50656) — https://www.helpnetsecurity.com/2026/06/17/rogueplanet-zero-day-cve-2026-50656/ — 2026-06-17 - Malwarebytes Labs — Microsoft fixes RoguePlanet zero-day in Defender — https://www.malwarebytes.com/blog/news/2026/07/microsoft-fixes-rogueplanet-zero-day-in-defender — 2026-07-09 ## 8\. Adverse Trace position ShieldBreak represents a high-severity local privilege-escalation risk (CVSS 7.8 HIGH for the underlying bypassed CVE-2026-50656) for EMEA financial services heavily invested in the Microsoft ecosystem, particularly those running Windows 11 25H2 and Windows Server 2025\. The exploit's ability to bypass a recent patch via a novel cfapi mechanism underscores the persistent risk from this single actor's campaign. Attribution to "Nightmare Eclipse" remains unconfirmed without a MITRE profile, and the actor's motivation appears retaliatory against Microsoft. We will monitor Microsoft's patch release cycle for a specific fix to the Cloud Filter API abuse vector and update clients with corresponding detection logic as it becomes available. --- [Read the original source →](https://www.theregister.com/security/2026/08/12/microsoft-vendetta-hacker-has-a-new-zero-day-that-gives-system-privileges-on-fully-patched-windows/5286889?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*