A public exploit called ShieldBreak defeats Microsoft’s July fix by turning Windows Defender into the escalation path. There is still no patch. That should change how security teams hear the phrase “fully patched.” ShieldBreak went public in mid-August, and it earns the attention it’s getting for a reason most privilege escalation stories don’t. It hits Microsoft twice in the same chain. First it bypasses Microsoft’s July patch for CVE-2026-50656, the Windows Defender race condition researchers nicknamed RoguePlanet. Then it does the bypassing by turning Defender itself into the mechanism of attack. A researcher publishing as Nightmare Eclipse released the code the week of August 11, tested it against Windows 11 25H2 and Windows Server 2025, and claimed a 100 percent success rate landing a SYSTEM shell. Will Dormann confirmed the exploit functions. Kevin Beaumont walked through the chain publicly. The bypass carries its own identifier, CVE-2026-69414, rated 7.8. Microsoft says it is investigating, has flagged exploitation as more likely, and as of this writing has not shipped a fix. Two caveats, stated plainly, because inflating this helps nobody. It’s local privilege escalation, not remote code execution, so an attacker needs a foothold first. And it only works where Defender is enabled. On most Windows fleets, that means everywhere. How Defender gets turned against itself What makes ShieldBreak more than a routine escalation bug is the path it takes to SYSTEM. Rather than avoiding Defender’s scanning, it recruits it. Per Beaumont’s analysis, the exploit hooks a user mode callback to swap file contents mid scan through the Cloud Filter API during a cloud hydration scan, chains that with CLFS log manipulation, and uses object manager symbolic links to point the scan where it wants it to go. The chain ends with a scheduled task running as SYSTEM. It doesn’t sneak past