🟠 High | Source: The Hacker News
A security researcher has released a proof-of-concept exploit for ‘ShieldBreak’, a zero-day vulnerability in Microsoft Defender that bypasses the patch for a previously disclosed flaw (CVE-2026-50656, ‘RoguePlanet’). The bypass reportedly allows an attacker to gain SYSTEM-level privileges on Windows, meaning full control of the affected machine. Patch bypasses are particularly serious as organisations that believed themselves protected may in fact remain vulnerable.
Security Architect’s Take: Treat any Windows endpoints and servers running Microsoft Defender as potentially unprotected against privilege escalation until Microsoft issues a verified remediation for the bypass; apply additional compensating controls such as enforcing Privileged Access Workstations (PAWs), restricting local admin rights, and monitoring for anomalous SYSTEM-level process creation via your SIEM whilst awaiting an official patch.
Original advisory: ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access