Nightmare Eclipse bypasses Microsoft patch with new Defender exploit

Microsoft’s latest Patch Tuesday addressed 236 Windows bugs, only for the disgruntled researcher Nightmare Eclipse to show up and punch a massive privilege escalation hole. It isn’t even new – the Windows Defender exploit bypasses the insufficient fix.

It’s already a tradition for the anonymous researcher Nightmare Eclipse, who blames Microsoft for ruining their life , to drop a new zero-day vulnerability immediately after a Patch Tuesday.

“New 0day in Defender, funny bug…,” the whole blog post of the researcher reads.

The new repository on GitHub and other platforms reveals a Windows Defender zero-day local privilege-escalation exploit, dubbed ShieldBreak. Attackers can run a simple script to allegedly gain SYSTEM-level privileges.

The researcher claims that proof of concept (PoC) was tested on fully patched Windows 11 25H2, including Canary channel and Windows Server 2025, and the PoC also has “a 100% success rate.”

“Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656 , this PoC demonstrates a full patch bypass,” the project’s readme document says.

The included screenshots demonstrate the exploit spawning a shell, where the whoami command returns the highest-privileged internal account “nt authority\system.”

ShieldBreak appears to exploit interactions among Microsoft Defender, Windows Cloud Files, and filesystem objects, tricking Defender into interacting with attacker-controlled files.

Microsoft’s advisory explain s that the original RoguePlanet bug was squashed by updating the Microsoft Malware Protection Engine – no installation of updates was required.

“In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine,” the advisory said.

“In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.”

The new exploit hasn’t been independently verified. However, the researcher haven’t misrepresented their findings before, which lends credibility to the claims. Their personal repository already contains 10 disclosed hacks. Some of them have already been abused by threat actors in the wild.

Microsoft previously called the researcher’s personal vendetta an “unnecessary risk” that put users at risk and forced its security teams to work around the clock.

Nightmare Eclipse dropped the new exploit hours after Microsoft Patch Tuesday security updates were released. They address 421 vulnerabilities in total, 236 of them affecting Windows and 98 affecting Office.

Vendors have been fixing record numbers of CVEs using artificial intelligence to only disprove the “AI is fixing everything” narrative. Some experts warn that record breaking numbers vulnerability numbers often represent a noise, not a signal.

According to VulnCheck report , Anthropic reported more than 23,000 findings through Project Glasswing, but only 126 have resulted in published CVEs, and just one has been confirmed as exploited in the wild.

FIRST Forecasting team's mid-year report notes that the volume of GitHub Security Advisories (GHSA) is up 449%, and VulnCheck is up 3,119%.

"When filtering the massive volume surge for actual exploitability... the actionable patching burden remains completely flat, “ the report reads. “Total rainfall is up significantly, the actual flooding risk has not changed.”