Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed

CVE-2026-69414

September 9, 2026 · The Hacker News · Severity: CRITICAL

This article reports that a security researcher has released a proof-of-concept exploit for a new zero-day vulnerability in Microsoft Defender, called ShieldCrash, which bypasses a recent patch for CVE-2026-69414. The vulnerability allows an attacker to achieve arbitrary file read as SYSTEM on all supported Windows versions, and Microsoft has issued an update to the Malware Protection Engine to address it. 📌 **Analyst Note:** This incident highlights the critical importance of thorough patch validation, as Microsoft's initial fix for ShieldBreak was incomplete and easily bypassed. Organizations should prioritize testing and deploying the latest Malware Protection Engine update and monitor for any signs of exploitation ta

The security researcher known as Chaotic Eclipse has dropped a proof-of-concept (PoC) for yet another zero-day in Microsoft Defender. The vulnerability, codenamed ShieldCrash , is assessed to be a patch bypass for CVE-2026-69414 (CVSS score: 7.8), also called ShieldBreak , which the researcher reported last month. "Microsoft has failed to properly patch ShieldBreak CVE-2026-69414," Chaotic Eclipse said. "Under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak. While Microsoft fixed several things to prevent re-exploiting the issue, they missed a spot where ShieldBreak can still be exploited." The PoC demonstrates an arbitrary file read as SYSTEM with the latest version of Windows installed. All supported versions of the desktop operating system are said to be impacted. The development comes days after Redmond shipped an update to the Microsoft Malware Protection Engine to plug CVE-2026-69414. The issue has been patched in Malware Protection Engine version 1.1.26080.3. It does not require any customer action and does not affect systems that have disabled Microsoft Defender. "In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine," the tech giant said . "In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner." "For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating." In recent weeks, Chaotic Eclipse has also released PoC exploits for four vulnerabilities impacting CrowdStrike Falcon Sensor (FalconFlank), Kaspersky (HardBreacher), Avast Antivirus (PrettyPrague), and NVIDIA (GreenSection). Both HardBreacher and PrettyPrague have since been patched by the respective security vendors, while CrowdStrike told The Hacker News that it's investigating the report. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Key Takeaways

Researcher Chaotic Eclipse released a proof-of-concept for ShieldCrash, a patch bypass for CVE-2026-69414 in Microsoft Defender, demonstrating an arbitrary file read as SYSTEM on all supported Windows versions.
Microsoft's patch for the original ShieldBreak vulnerability in Malware Protection Engine version 1.1.26080.3 failed to fully address the issue, leaving a specific exploitation path still viable under certain conditions.
The researcher has also published PoC exploits for vulnerabilities in CrowdStrike Falcon Sensor, Kaspersky, and Avast Antivirus, indicating a broader trend of targeting endpoint security products.