Days after Microsoft shipped its largest-ever monthly security update - covering roughly 970 vulnerabilities, including two exploited zero-days and 113 rated critical - a researcher who goes by Nightmare Eclipse released a new Microsoft Defender zero-day exploit called ShieldCrash.
The proof-of-concept demonstrates an arbitrary file read with System privileges, but the underlying flaw can be pushed further to gain full System rights - enough to dump the SAM database of password hashes, according to SecurityWeek. Crucially, it works against fully patched Windows machines.
ShieldCrash is the third link in a chain of Defender privilege-escalation bugs. It follows ShieldBreak, dropped on the August 2026 Patch Tuesday as a bypass for Microsoft's fixes to RoguePlanet (CVE-2026-50656), a race condition patched in July. Microsoft acknowledged ShieldBreak (CVE-2026-69414) on Aug. 14 and shipped fixes on Sept. 3, which the researcher says are incomplete.
The pattern, not the individual bug, is the story. 'When researchers can bypass successive fixes for RoguePlanet and ShieldBreak, it suggests the underlying security boundary or attack surface may require a more comprehensive redesign rather than another narrowly targeted patch,' SOCRadar CISO Ensar Seker told SecurityWeek. Security teams are advised to enable Defender tamper protection, tighten admin access and local execution paths, and watch for suspicious process behaviour around Defender components. Microsoft has not yet responded publicly.
Sources
- securityweek.comNew 'ShieldCrash' Zero-Day Exploit Targets Microsoft Defender — SecurityWeek
- thezdi.comThe September 2026 Security Update Review — Zero Day Initiative
- crowdstrike.comSeptember 2026 Patch Tuesday: Updates and Analysis — CrowdStrike
- hkcert.orgMicrosoft Monthly Security Update (September 2026) — HKCERT
