Researcher releases Microsoft Defender bypass days after patch
Security researcher Nightmare Eclipse, also known as MSNightmare, has released another proof-of-concept exploit targeting Microsoft Defender, this time for a flaw dubbed ShieldCrash that bypasses a patch issued only last week. The exploit reportedly allows attackers to read files with SYSTEM-level privileges even on Windows machines that have installed September's Patch Tuesday updates, continuing the researcher's pattern of publishing new bugs almost immediately after Microsoft ships fixes. This matters because it exposes an ongoing weakness in Defender's privilege protections and puts pressure on Microsoft to respond quickly, though the company has not yet said when a fix will arrive.
ShieldCrash is a bypass of ShieldBreak (CVE-2026-69414), itself a bypass of an earlier flaw called RoguePlanet (CVE-2026-50656); Microsoft patched RoguePlanet in July and ShieldBreak just last week. Nightmare describes ShieldCrash as a "skeleton" proof-of-concept limited to arbitrary file reads rather than full SYSTEM control, and it is the researcher's eleventh Microsoft zero-day, part of what they have called a personal vendetta against the company. They have also recently branched out to other vendors, publishing exploits affecting CrowdStrike Falcon, Kaspersky and Avast, with several confirmed working by security researcher Kevin Beaumont.
In short
- Researcher drops new Defender SYSTEM-privilege exploit, ShieldCrash, bypassing a patch from last week
- It's the researcher's 11th Microsoft zero-day; Microsoft hasn't confirmed a patch timeline
- Same researcher recently hit CrowdStrike, Kaspersky and Avast with separate exploits
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Publishing a working proof of concept can show that a patch failed in practice, give defenders concrete evidence to assess exposure and press Microsoft to fix a recurring weakness. The researcher says this is a limited file-read demonstration rather than full SYSTEM control, and prompt disclosure may help organisations and the vendor understand the risk sooner.
The case against
Releasing an exploit so soon after a patch may give attackers a usable lead before Microsoft can issue another fix, putting users and organisations at risk. Given the reported pattern of bypasses and the researcher's stated vendetta, critics could reasonably question whether immediate public release serves users better than allowing time for coordinated remediation.
Explained simply
Microsoft Defender is the security software built into Windows. It runs with high system privileges so it can scan files and protect the computer, but bugs in how it handles files can sometimes let other software access information it should not be able to reach.
The researcher behind ShieldCrash has published several flaws in Defender. ShieldCrash follows RoguePlanet and ShieldBreak, two earlier flaws that Microsoft has patched; each later bug bypassed a previous fix. The researcher says this proof of concept can read files with SYSTEM-level privileges, but does not give full control of a computer.
The issue matters because files accessible at this privilege level may contain sensitive information, and the repeated bypasses raise questions about how well Defender’s protections withstand fixes. The researcher has also published flaws affecting other security software, including products from CrowdStrike, Kaspersky and Avast.
Read the full article at the source →
Originally published by The Register as “Serial Microsoft 0-day hunter drops yet another Defender exploit”.