Security researcher Nightmare Eclipse has published details of a new Windows zero-day called ShieldBreak that can give attackers system-wide access to affected devices.
ShieldBreak exploits a flaw in Windows Defender, the security engine built into Windows, and can escalate privileges from a low-level user to full access to the device and its data, according to Nightmare Eclipse.
Nightmare Eclipse published a proof-of-concept exploit as a Windows application that must be run by the user to trigger the bug. The researcher said the flaw affects Windows 10, Windows 11, including version 25H2, and Windows Server 2025.
Security researcher Will Dormann verified that the bug works and said Windows Defender must be enabled for the exploit to succeed.
The exploit builds on an earlier technique called RoguePlanet, according to Nightmare Eclipse. Microsoft previously patched RoguePlanet, but Nightmare Eclipse said ShieldBreak shows a full bypass of that earlier fix.
Microsoft has not released a patch for ShieldBreak. The flaw qualifies as a zero-day because it was disclosed publicly before Microsoft had time to issue a fix.
A Microsoft spokesperson said the company is “aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims.”
The disclosure extends a dispute between Nightmare Eclipse and Microsoft over the company’s handling of bug reports. In blog posts, Nightmare Eclipse said Microsoft mishandled prior submissions and left the researcher with no option but public disclosure.
Nightmare Eclipse previously disclosed several other Windows bugs that were later used in real-world attacks against organizations.
In May, Microsoft said in a blog post that it could take legal action against security researchers who publish zero-day details outside its disclosure policies. The post drew criticism from members of the security community, and Microsoft later softened its position in a social media post, while leaving the original blog post unchanged.
ShieldBreak was disclosed a day after Microsoft’s monthly Patch Tuesday release. The latest patch cycle brought the number of fixes to about 500 for a second straight month, driven in part by the company’s growing use of AI to identify security flaws.
Featured image credit
