ShieldBreak: Defender Patch Bypass PoC Published

PoC out. Claim: August’s Defender patch is bypassable.

CVE-2026-50656 (CVSS 7.8, High) — privilege escalation in Microsoft Defender for Windows — was patched in this week’s Patch Tuesday. Hours later, a researcher published ShieldBreak: a proof-of-concept asserting the fix doesn’t hold.

The claim

The researcher: “Nightmare Eclipse,” also going by Chaotic Eclipse, INFINITE NIGHTMARE, MSNightmare. The assertion: ShieldBreak bypasses the August patch for CVE-2026-50656 — tracked internally as RoguePlanet — and achieves SYSTEM-level access on a fully-patched system. BleepingComputer and The Hacker News have coverage.

Confidence: unconfirmed

Microsoft has issued no out-of-band guidance. No independent researcher has publicly validated the bypass as of this writing. Single-source PoC claim — treat accordingly.

Exploitation in the wild: none reported.

What changes if the bypass holds

CVE-2026-50656 is a local privilege escalation — the attacker needs a foothold first. That requirement doesn’t change if the bypass is real. What changes: teams that checked “patch applied, done” against Defender this week don’t have the certainty they assumed.

The practical risk window: if ShieldBreak holds up under scrutiny, organizations running the August Defender update are back to an open LPE vector until Microsoft pushes a second fix. Local privilege escalation is how initial access becomes full system compromise.

Watch

• Microsoft MSRC for acknowledgment or out-of-band advisory
• Independent researcher validation of the bypass claim
• Whether ShieldBreak is assigned its own CVE or remains attached to CVE-2026-50656

Previous coverage: Microsoft August 2026 Patch Tuesday — full triage