Hacker Releases Windows Zero-Day That Grants System Access on Patched Machines

A security researcher known as Nightmare Eclipse has published a new Windows zero-day exploit called ShieldBreak that allows attackers to gain SYSTEM-level privileges on fully patched Windows 10, Windows 11, and Windows Server systems, according to a report from The Register. The exploit surfaced just hours after Microsoft's August Patch Tuesday, which addressed 421 security issues but didn't include a fix for ShieldBreak. Nightmare Eclipse, believed to be a former Microsoft employee with a grudge against the company, has now released 10 zero-day vulnerabilities since launching what the report describes as a "scorched-earth strategy" against Microsoft in early April.

ShieldBreak is a local privilege-escalation exploit that Nightmare Eclipse says achieves a 100% success rate on the latest Windows 11 25H2 and Windows Server 2025 versions. Former Microsoft security expert Kevin Beaumont confirmed the vulnerability works, stating he tested it on the newest Windows 11 build. While Nightmare Eclipse characterizes ShieldBreak as a bypass for an earlier flaw called RoguePlanet (CVE-2026-50656) that Microsoft quietly patched in July, Beaumont noted the two vulnerabilities operate through different mechanisms: RoguePlanet exploited a filesystem race condition using virtual disks, while ShieldBreak uses a user-mode callback hook to alter file contents during a Defender cloud-hydration scan through the Cloud Filter API. Windows 10 and corresponding server editions remain vulnerable to ShieldBreak, though the proof-of-concept code doesn't currently support them.

A Microsoft spokesperson told The Register the company is investigating the reported vulnerability and its potential applicability. The spokesperson emphasized that "Microsoft is committed to investigating security issues and updating impacted products to protect customers as soon as possible," while noting the company supports coordinated vulnerability disclosure as an industry standard. Beaumont published three detection and hunting queries for ShieldBreak to help security teams identify threats until Microsoft issues a patch.

The timing and frequency of Nightmare Eclipse's disclosures highlight a pattern of releasing exploits immediately after Microsoft's monthly security updates. Of the 10 zero-days released since April, seven have received official patches from Microsoft: BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma (CVE-2026-45586), MiniPlasma (CVE-2020-17103), and RoguePlanet (CVE-2026-50656). Three remain unpatched, including ShieldBreak, a July vulnerability called LegacyHive that targets Windows user hives in the Registry, and a June flaw named GreatXML that allegedly allows attackers with administrator rights to bypass BitLocker encryption by manipulating the Windows Recovery Environment. After threatening legal action against Nightmare Eclipse in May through its Digital Crimes Unit, Microsoft reversed course following backlash from the broader security research community. Organizations running Windows should implement Beaumont's detection queries immediately to monitor for exploitation attempts until a fix arrives, particularly given the exploit's confirmed effectiveness and 100% success rate on current systems. The vulnerability underscores the tension between coordinated disclosure practices and the immediate security needs of defenders when patches lag behind public exploits.