Microsoft Defender "ShieldBreak" Zero-Day Bypasses August Patch Tuesday Fix to Grant SYSTEM Privileges

Scope: Windows 10, Windows 11, Windows Server 2025 and Later (All Fully Patched Builds as of August 12, 2026)

Severity: Red

Nightmare Eclipse, the same researcher behind LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, and MiniPlasma, released ShieldBreak hours after Microsoft's August 2026 Patch Tuesday, describing it as a full bypass of the RoguePlanet patch (CVE-2026-50656) that Microsoft shipped today. The exploit targets Microsoft Defender and grants SYSTEM-level privileges on fully patched Windows 11 and Windows Server 2025 systems with a 100 percent success rate, independently confirmed by principal vulnerability analyst Will Dormann. This class of vulnerability is routinely paired with phishing or ransomware initial access to complete a full system takeover, and every prior disclosure from this researcher has been confirmed exploited in the wild within days of release. No official patch exists yet. Organizations should monitor MSRC for an out-of-band update and ensure Microsoft Defender is enabled alongside additional endpoint controls as patching is pending.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.