CVE-2026-50656 ShieldBreak Bypasses Defender Patch

A researcher has published ShieldBreak, a proof of concept that claims to bypass Microsoft Defender’s fix for CVE-2026-50656, also tracked as RoguePlanet. The technique was first reported by The Hacker News on August 12, 2026, and later analyzed by several firms and specialist outlets, which described it as an evasion of the correction Microsoft applied.

What the PoC does

According to Braincap, the technique can elevate privileges to SYSTEM on Windows, but it requires the attacker to already have local access to the machine. The Hacker News also reported that Will Dormann validated the PoC and said Defender must be enabled for the exploit to work. Computerworld added that the PoC gives system-level control to attackers who have already gained access and that, according to Steven Eric Fisher, there would be independent confirmation that ShieldBreak works.

How it works

Tanium said Nightmare, also referred to as Chaotic Eclipse, published ShieldBreak on August 11 and 12, 2026 as a proof of concept that reopens the same race condition as RoguePlanet, but with a different technique. The chain described combines registering a cloud storage provider, using CLFS, and Object Manager symbolic links to replace a system file reported as phoneinfo.dll during Defender processing.

SecurityWeek expanded on the technical flow and said the exploit registers a temporary directory as a Cloud Sync provider, plants an EICAR file to force a scan, manipulates CLFS to redirect hydration metadata toward phoneinfo.dll in System32, and then triggers the scheduled QueueReporting task to obtain a SYSTEM shell.

Scope and mitigation status

ThreatLocker described ShieldBreak as a proof of concept that bypasses Microsoft’s fix for CVE-2026-50656 and said there was, at the time, no specific patch for ShieldBreak. SecurityArsenal agreed that no dedicated fix existed and that mitigation depended on compensating controls, Defender hardening, and custom detection rules.

Malware.news said the bypass works with a 100% success rate on Windows 11 25H2, including the Canary channel, and on Windows Server 2025, with better reliability than the original RoguePlanet exploit. The Register added that Windows 10 and its server editions remain vulnerable to the same underlying weakness, although the public PoC does not include official support for those versions.

CVE context

The official NVD listing for CVE-2026-50656 describes RoguePlanet as a privilege escalation in Microsoft Defender’s Microsoft Malware Protection Engine, acknowledged by Microsoft. Blogspan.net noted that the security advisory tied to that CVE had not been updated after ShieldBreak was published and was still at revision 2.0 from July 8, 2026, despite the PoC showing a full bypass of the fix.

CyberWorldOps attributed the exploit to Chaotic Eclipse, INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse, and placed it within a sustained campaign of zero-day publication against Microsoft Defender. The Register, meanwhile, cited Kevin Beaumont to clarify that ShieldBreak presents itself as a direct bypass of RoguePlanet, but its operating method is technically different from the original exploit.