Only days after Microsoft published it’s fix for “ShieldBreak”, a privilege escalation vulnerability in the Windows Defender Malware Protection Engine, researcher Nightmare Eclipse published a new “ShieldCrash” proof of concept exploit showing that Msoft’s vulnerability can still be activated.
The POC was released on GitHub, “demonstrates an arbitrary file read as SYSTEM with September 2026” and is said to impact all Windows versions.
“Under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak. While Microsoft fixed several things to prevent re-exploiting the issue, they missed a spot where ShieldBreak can still be exploited,” Nightmare Eclipse said in the GitHub “README” file for ShieldCrash.
Yasir Zahid, Cybersecurity leader, Founding Member, Secure.com
“The bigger worry here is not one exploit. It is the pattern. This is the third time in a row that a fix for the same Defender component has been bypassed right after Patch Tuesday. When a patch keeps missing the mark, the real problem is the attack surface underneath it, not the individual bug.
“On whether it works: independent public testing on fully updated Windows 10, 11, and Server systems suggests the exploit is functional, at least for reading files as SYSTEM and the attacker already needs a local foothold to use it. So the risk is real but bounded.
Watch your Defender health as a live signal, tighten local access controls, and treat your own security tools as an attack surface. If a researcher can probe it, an attacker can too. Test your defences the way an attacker would, then fix what breaks.”
Denis Calderone, CTO, Suzu Labs (https://suzulabs.com/home-suzu-labs):
“ShieldCrash is the third iteration of the same underlying race condition in the Malware Protection Engine. RoguePlanet came first in June, Microsoft patched it in July. ShieldBreak bypassed that patch in August, Microsoft patched it September 3. ShieldCrash dropped two hours after Patch Tuesday claiming the September 3 fix was incomplete.
“The current PoC is a skeleton, the researcher’s own words, that demonstrates arbitrary file reads as SYSTEM but not a full SYSTEM shell or arbitrary writes. That is still meaningful because reading files as SYSTEM means you can pull the SAM database, credential stores, and configuration data off a fully patched box.
“On the viability question, I can’t confirm it from a lab, but the circumstantial case for taking this seriously is strong. This is Nightmare Eclipse’s eleventh Microsoft zero-day. Kevin Beaumont independently verified that their prior exploits work. CrowdStrike’s Patch Tuesday analysis says this researcher’s claims have historically been found to be accurate. And honestly, the fact that the researcher is calling this a skeleton PoC and openly admitting it only does file reads rather than overclaiming a full SYSTEM shell actually adds credibility in my opinion. There is no CVE assigned and no Microsoft patch or mitigation available as of September 10th.”
Microsoft clearly has an issue that it can’t solve. At least not yet. The question is, if Microsoft can actually solve it before the bad guys exploit it.
Related
This entry was posted on September 11, 2026 at 8:12 am and is filed under Commentary with tags Microsoft. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
New POC skirts Microsoft’s zero-day ShieldBreak patch
Only days after Microsoft published it’s fix for “ShieldBreak”, a privilege escalation vulnerability in the Windows Defender Malware Protection Engine, researcher Nightmare Eclipse published a new “ShieldCrash” proof of concept exploit showing that Msoft’s vulnerability can still be activated.
The POC was released on GitHub, “demonstrates an arbitrary file read as SYSTEM with September 2026” and is said to impact all Windows versions.
“Under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak. While Microsoft fixed several things to prevent re-exploiting the issue, they missed a spot where ShieldBreak can still be exploited,” Nightmare Eclipse said in the GitHub “README” file for ShieldCrash.
Yasir Zahid, Cybersecurity leader, Founding Member, Secure.com
“The bigger worry here is not one exploit. It is the pattern. This is the third time in a row that a fix for the same Defender component has been bypassed right after Patch Tuesday. When a patch keeps missing the mark, the real problem is the attack surface underneath it, not the individual bug.
“On whether it works: independent public testing on fully updated Windows 10, 11, and Server systems suggests the exploit is functional, at least for reading files as SYSTEM and the attacker already needs a local foothold to use it. So the risk is real but bounded.
Watch your Defender health as a live signal, tighten local access controls, and treat your own security tools as an attack surface. If a researcher can probe it, an attacker can too. Test your defences the way an attacker would, then fix what breaks.”
Denis Calderone, CTO, Suzu Labs (https://suzulabs.com/home-suzu-labs):
“ShieldCrash is the third iteration of the same underlying race condition in the Malware Protection Engine. RoguePlanet came first in June, Microsoft patched it in July. ShieldBreak bypassed that patch in August, Microsoft patched it September 3. ShieldCrash dropped two hours after Patch Tuesday claiming the September 3 fix was incomplete.
“The current PoC is a skeleton, the researcher’s own words, that demonstrates arbitrary file reads as SYSTEM but not a full SYSTEM shell or arbitrary writes. That is still meaningful because reading files as SYSTEM means you can pull the SAM database, credential stores, and configuration data off a fully patched box.
“On the viability question, I can’t confirm it from a lab, but the circumstantial case for taking this seriously is strong. This is Nightmare Eclipse’s eleventh Microsoft zero-day. Kevin Beaumont independently verified that their prior exploits work. CrowdStrike’s Patch Tuesday analysis says this researcher’s claims have historically been found to be accurate. And honestly, the fact that the researcher is calling this a skeleton PoC and openly admitting it only does file reads rather than overclaiming a full SYSTEM shell actually adds credibility in my opinion. There is no CVE assigned and no Microsoft patch or mitigation available as of September 10th.”
Microsoft clearly has an issue that it can’t solve. At least not yet. The question is, if Microsoft can actually solve it before the bad guys exploit it.
Share this:
Like this:
Related
This entry was posted on September 11, 2026 at 8:12 am and is filed under Commentary with tags Microsoft. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.