Home / Technology / Defender Flaw 'ShieldBreak' Exposes Windows Users
Defender Flaw 'ShieldBreak' Exposes Windows Users
12 Aug
Summary
- A new zero-day vulnerability named ShieldBreak affects Windows Defender.
- The flaw allows attackers with existing access to gain system-level privileges.
- Researcher Nightmare Eclipse previously disclosed other Windows flaws.
A significant zero-day vulnerability, dubbed ShieldBreak, has been disclosed by security researcher Nightmare Eclipse, targeting Windows Defender. This flaw allows an attacker who has already gained initial access to escalate their privileges to the highest 'system' level on affected Windows machines.
Proof-of-concept code released by Nightmare Eclipse confirms the exploit's effectiveness on Windows 11 version 25H2 and Windows Server 2025, provided Windows Defender is enabled. This discovery follows the researcher's earlier report of a similar privilege escalation bug, Rogue Planet, which Microsoft patched earlier this year.
Nightmare Eclipse, a former Microsoft employee, has expressed grievances with the company, leading to a deliberate decision to bypass coordination for patching vulnerabilities. The researcher has also previously disclosed another zero-day flaw, BlueHammer. Microsoft's stance on legal action against researchers publishing unpatched vulnerability details has evolved following community backlash, with the company stating they will not pursue legal action against those conducting legitimate security research.
