ShieldCrash Finds a Defender File-Reading Route After the Patch
September's Patch Tuesday had barely passed when researcher Nightmare Eclipse published code for a new Defender exploit. ShieldCrash can read arbitrary files with SYSTEM privileges on fully updated Windows 10 and Windows 11. Windows Server systems are affected too, but the proof of concept does not show file writing or an elevated shell.
ShieldBreak, tracked as CVE-2026-69414, is an elevation-of-privilege flaw in the Microsoft Malware Protection Engine. The Defender component scans for malware and detects it. It also cleans infections. The flaw carries a CVSS score of 7.8 and affects engine versions up to and including 1.1.26070.7, according to Tenable's vulnerability record. Microsoft delivers the fix through an engine update, not a conventional Windows security package. Administrators should enable automatic engine updates and check the installed engine version.
ShieldCrash remains read-only. SYSTEM access can still expose data that an ordinary user cannot reach, including service configurations. The exploit may also expose keys and password hashes. Nightmare Eclipse says it can reach the SAM, Windows' local account database.
A bypass after the ShieldBreak patch
Nightmare Eclipse published ShieldCrash on 8 and 9 September 2026, hours after September's Patch Tuesday. The researcher says Microsoft's early-September ShieldBreak fix closed several paths but left one route open under particular conditions. ShieldCrash is described as a bypass of that fix, not a separately assigned vulnerability. It has no separate CVE identifier or CVSS score.
The difference between the exploits is clear: ShieldBreak opened a SYSTEM shell. ShieldCrash currently demonstrates file reading only. Its author called the release a "skeleton", not a completed shell or file-writing exploit. The proof of concept reads arbitrary files with SYSTEM privileges on a current Windows version. The researcher also said all supported desktop versions of Windows are affected.
The sequence began earlier in the summer. RoguePlanet, tracked as CVE-2026-50656, was a Defender race condition that opened a SYSTEM shell. Microsoft closed it on 9 July with Malware Protection Engine version 1.1.26060.3008. RoguePlanet also received a CVSS rating of 7.8. Microsoft issued additional defense-in-depth changes with the fix.
ShieldBreak appeared on 12 August, hours after that month's Patch Tuesday, and was claimed to bypass the RoguePlanet patch. Former Microsoft employee and security analyst Kevin Beaumont confirmed that ShieldBreak worked on the latest Windows 11.
Defender is one target in a wider campaign
ShieldCrash follows other disclosures involving security products. Their high privileges can make flaws useful to attackers. In late August, HardBreacher targeted Kaspersky Endpoint Security. Kaspersky addressed it with an automatic update.
In the week before 7 September, Nightmare Eclipse published PrettyPrague, which targeted the Avast sandbox and could also affect AVG and Norton. The researcher also published FalconFlank, involving CrowdStrike Falcon Sensor's Office macro-removal feature. GreenSection involved an Nvidia driver component.
GenDigital released a fix for PrettyPrague. CrowdStrike was investigating FalconFlank and advised disabling the setting. Nvidia began a root-cause analysis. Beaumont verified the Avast exploit. He also verified the CrowdStrike and Kaspersky exploits.
The researcher's identity and alleged motive remain unconfirmed. Social media claims that Nightmare Eclipse is a former employee seeking revenge have not been established. A Barracuda analysis called the claim unverified, while noting that the researcher's familiarity with the code could indicate insider knowledge.
The researcher also claims Microsoft ignored reports, closed the submission account and had repositories removed from GitHub and GitLab. Those allegations have been reported as unverified. Microsoft described the disclosures in May as non-compliant with coordinated vulnerability disclosure and invoked its Digital Crimes Unit. The company later said it did not intend to target legitimate security research.
ShieldCrash requires local access, so an attacker would already need a presence on the affected machine. A separate KVM escape report covered a different privilege-boundary flaw in Linux virtualization. ShieldCrash concerns file access through Defender on Windows.
Coverage dated 9-11 September reported no ShieldCrash patch or Microsoft statement. Until an update is available, administrators should keep the Defender engine current and retain real-time protection along with Tamper Protection. They should restrict local administrative rights. They should also watch for anomalous processes associated with Defender mechanisms. Engine updates arrive separately from Patch Tuesday. Disabling Defender would leave systems exposed to other threats.
