Microsoft Defender ShieldCrash PoC: SYSTEM file-read after ShieldBreak patch (Sep 2026)
BleepingComputer (9 September 2026) reports anonymous researcher Nightmare Eclipse released a ShieldCrash proof-of-concept against Microsoft Defender immediately after September 2026 Patch Tuesday. The researcher claims ShieldCrash bypasses the ShieldBreak elevation issue patched as CVE-2026-69414 and demonstrates arbitrary file read as SYSTEM on fully patched Windows 10, Windows 11, and Windows Server, without write access to the compromised system. ShieldBreak itself followed RoguePlanet (disclosed June, patched July). Microsoft had not commented to BleepingComputer at publish. Treat as a local privilege-escalation research drop / incomplete patch claim — not a remote wormable CVE. No Australian exploitation signal on this pass. Primary: BleepingComputer.
- Product
- Microsoft Defender / Windows 10, Windows 11, Windows Server
- Versions
- Claimed still reachable after September 2026 patches that addressed ShieldBreak CVE-2026-69414 — confirm against MSRC when Microsoft publishes
- Exploited in Australia?
- unknown
- Patch to
- Monitor MSRC for a follow-up Defender/Windows fix; limit local admin and EDR tamper; treat PoC as LPE research
Primary: BleepingComputer — ShieldCrash (9 Sep 2026) · Vendor: Microsoft Security Update Guide (no ShieldCrash advisory at write-up) · CVE: CVE-2026-69414 · The Hacker News (9 Sep 2026)