ShieldBreak: Defender RoguePlanet Patch Bypass (CVE-2026-69414)

Summary

ShieldBreak is the NightmareEclipse / MSNightmare follow-on to RoguePlanet: a published local privilege-escalation proof-of-concept that the author describes as a full bypass of Microsoft’s attempt to close the Defender quarantine-pipeline race (tracked by the researcher as CVE-2026-50656). The Nightcrawler repo first appeared 2026-08-11 and was still being updated 2026-09-08.

Microsoft acknowledged the technique in an MSRC advisory on 2026-08-14, naming an elevation of privilege in the Microsoft Malware Protection Engine (MsMpEng.exe) and assigning CVE-2026-69414. Switzerland’s NCSC and CERT-FR relayed that ID on 2026-08-17. MSRC revision 2.0 on 2026-09-03 shipped Malware Protection Engine 1.1.26080.3 as the first build that addresses the CVE (last affected engine listed as 1.1.26070.7). Five days later the same researcher published ShieldCrash, claiming that engine still leaves a gap — currently framed as SYSTEM-context arbitrary file read, not a restored full LPE.

OFFSITE.DARK indexes the forge appearance and vendor acknowledgements. We did not discover or weaponize this flaw.

Key Findings

Relationship to RoguePlanet

RoguePlanet (June 2026) abused Defender’s own quarantine write plus WER QueueReporting to reach SYSTEM. Microsoft later shipped engine-side hardening associated with CVE-2026-50656. ShieldBreak is the author’s statement that the hardening was incomplete: same product family, same integrity target, new public PoC after the patch window.

Treat CVE-2026-50656 and CVE-2026-69414 as distinct IDs. An estate that applied August engine/OS updates for the former is not automatically closed for the latter.

Cluster (August–September 2026 expansion)

The researcher moved from Microsoft-only surfaces into other AV/EDR vendors in the same two-week window. Local code execution remains the prerequisite for all of these.

Impact

• Standard user → SYSTEM on hosts still below engine 1.1.26080.3. Hosts on that build are closed by Microsoft for this CVE’s original LPE and still in scope for ShieldCrash.
• Compensating controls that assume “Defender is the last line after patch Tuesday” fail if the engine itself is the escalation path.
• Dual-use research circulation: prior NightmareEclipse tools (BlueHammer, RedSun, UnDefend) already appeared in real Huntress-documented intrusions. ShieldBreak should be hunted as a successor primitive, not assumed to stay PoC-only.

Mitigation

1. Deploy Malware Protection Engine 1.1.26080.3 or later; do not treat CVE-2026-50656 as the close-out. Then read ShieldCrash — that build is not the end of the class.
2. Hunt for unexpected SYSTEM children of MsMpEng.exe / WER wermgr.exe and for Nightcrawler/GitHub sample hashes of the published binary (signature evasion is expected).
3. Keep RoguePlanet-family behavioral detections (junction + oplock + WER / Cloud Filter path redirection) even after 1.1.26080.3.
4. Reduce local-code-execution blast radius: AppLocker / WDAC, standard-user defaults, and EDR isolation on high-value workstations.
5. Block or monitor egress to git.projectnightcrawler.dev on production endpoints where policy requires (Project Nightcrawler tools note).

Related Signals

• ShieldCrash: Incomplete ShieldBreak Patch, SYSTEM File Read
• RoguePlanet: Defender Quarantine Pipeline LPE
• LegacyHive: ProfSvc Hive Load
• FalconFlank: CrowdStrike Falcon LPE
• HardBreacher: Kaspersky Endpoint LPE

Sources

• Project Nightcrawler — NightmareEclipse/ShieldBreak
• MSRC advisory — CVE-2026-69414 (rev 2.0, 2026-09-03: engine 1.1.26080.3)
• NCSC-CH rolling Nightmare Eclipse advisory (2026-08-17) and CERTFR-2026-AVI-1035
• OFFSITE.DARK — RoguePlanet