INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

ShieldCrash Zero-Day Exploit

| 2026-09-09 07:53 CRITICAL HIGH EXPLOITED VULNERABILITY
JSON
Executive Summary
AI-generated
The recent release of exploits by Chaotic Eclipse targeting other anti-malware and defense solutions has raised concerns about the vulnerability of Microsoft products, particularly Windows 11. The researcher claims that Microsoft has not fully fixed a critical vulnerability (CVE-2026-69414) known as ShieldBreak, which allows attackers to gain SYSTEM-level access on vulnerable systems. This flaw was exploited in a proof-of-concept (PoC) by FalconFlank, demonstrating an arbitrary file read with September 2026, all supported Windows versions are affected. Microsoft has since updated the Malware Protection Engine to fix this vulnerability, but not before releasing new zero-day exploits targeting Nvidia and other products. The researcher's releases have mainly targeted Microsoft products, including Windows and Microsoft Defender, highlighting a potential security risk for users of these systems.
Technical Mitigations AI-generated
I can provide the following technical mitigations: * Implement a patch or update to Microsoft Defender and its associated components, such as the Malware Protection Engine (MPE), to fix the CVE-2026-69414 vulnerability. * Configure Windows systems with Microsoft Defender to automatically check for updates and install any available patches. * Use an anti-malware solution that is regularly updated and patched to minimize the risk of exploitation by this zero-day vulnerability. * Monitor system logs and event records for signs of unauthorized access or attempts to exploit the ShieldCrash vulnerability. * Consider implementing a security information and event management (SIEM) system to detect and respond to potential threats associated with this vulnerability.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 118 IoCs Create Free Account
se•••@bl•••.•••
hxxp://••••••••••••••••••••
hxxp://••••••••••••••••••••
hxxp://••••••••••••••••••••
hxxp://••••••••••••••••••••
zt•••••.com
tr•••••.io
hu•••••.li
ww•••••.com
10•••••.jpg
10•••••.jpg
10•••••.jpg
10•••••.png
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters CVE-2026-69414CVE-2026-69414
Target & Sectors
NORTH_AMERICA NORTH_AMERICA
Incident Timeline
‎2016 August
Threat actors used Microsoft Defender's Zero-Day exploit T1584.004 on Windows Server 2016 to trigger the 0xc0000409 error.
infrastructure Windows
[Image 5: August updates trigger 0xc0000409 errors on Windows Server 2016 August updates trigger 0xc0000409 errors on Windows Server 2016]( * !
tactic T1584.004 - Server
[Image 5: August updates trigger 0xc0000409 errors on Windows Server 2016 August updates trigger 0xc0000409 errors on Windows Server 2016]( * !
infrastructure 2016 Windows Server
[Image 5: August updates trigger 0xc0000409 errors on Windows Server 2016 August updates trigger 0xc0000409 errors on Windows Server 2016]( * !
‎2026/09/02
Chaotic Eclipse released a new zero-day exploit targeting Nvidia on September 2, 2026.
‎September 09, 2026
Chaotic Eclipse released ShieldCrash, a proof of concept exploit for the Microsoft Defender Zero-Day vulnerability known as ShieldBreak.
infrastructure Windows
The researcher published a proof of concept (PoC) that can read arbitrary files with SYSTEM privileges, the highest level of access on Windows.
organisation ShieldBreak
The researcher claims that Microsoft has not fully fixed the ShieldBreak vulnerability (CVE-2026-69414).
organisation Microsoft
The researcher Chaotic Eclipse released ShieldCrash, a PoC exploit for a Microsoft Defender Zero-Day vulnerability.
organisation INFINITE NIGHTMARE
Security researcher  Chaotic Eclipse , also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Microsoft Defender.
organisation MSNightmare
Security researcher  Chaotic Eclipse , also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Microsoft Defender.
organisation Nightmare
Security researcher  Chaotic Eclipse , also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Microsoft Defender.
‎September 9, 2026
Threat actors used Microsoft Defender's ShieldCrash exploit to gain SYSTEM access.
organisation ThreatLocker
[Image 34: ThreatLocker]( * Home * News * Security * New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access # New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access By ###### Sergiu Gatlan * September 9, 2026 * 03:30 AM * 0 !
data_breach 0 September
[Image 34: ThreatLocker]( * Home * News * Security * New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access # New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access By ###### Sergiu Gatlan * September 9, 2026 * 03:30 AM * 0 !
‎September 2026
Chaotic Eclipse released a Microsoft Defender zero-day exploit named "ShieldCrash" which exploits a privilege escalation flaw in the Malware Protection Engine.
infrastructure Windows
He says all supported Windows versions remain vulnerable, even after the September 2026 security updates.
“This PoC demonstrates an arbitrary file read as SYSTEM with September 2026, all supported windows versions are affected.”
"This PoC demonstrates an arbitrary file read as SYSTEM with September 2026, all supported windows versions are affected.
Nightmare Eclipse says the Kaspersky Endpoint Security zero-day allows privilege escalation on a fully patched Windows 11 25H2 system running Kaspersky Endpoint v14.0.0.504.
The PoC exploits a flaw in Avast Sandbox to dump the Windows SAM database and gain a SYSTEM-level shell.
It reportedly works even on fully patched Avast Antivirus and Windows 11 25H2.
His releases have mainly targeted Microsoft products, including Windows and Microsoft Defender, with some later exploited in the wild.
organisation PoC
"This PoC demonstrates an arbitrary file read as SYSTEM with September 2026, all supported windows versions are affected.
organisation Microsoft
[Image 2: Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days]( * !
general_metric 2 Video
[Image 2: Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days]( * !
general_metric 966 flaws
[Image 2: Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days]( * !
organisation Microsoft Defender
Image 35: Microsoft Defender An anonymous security researcher known as Nightmare Eclipse has released a new Microsoft Defender zero-day exploit named "ShieldCrash" right after Microsoft rolled out its September 2026
organisation Nightmare
Image 35: Microsoft Defender An anonymous security researcher known as Nightmare Eclipse has released a new Microsoft Defender zero-day exploit named "ShieldCrash" right after Microsoft rolled out its September 2026
organisation Kaspersky Endpoint Security
Chaotic Eclipse  released a zero-day exploit targeting Kaspersky Endpoint Security he named  HardBreacher , which triggers a privilege escalation flaw.
organisation HardBreacher
Chaotic Eclipse  released a zero-day exploit targeting Kaspersky Endpoint Security he named  HardBreacher , which triggers a privilege escalation flaw.
organisation the Kaspersky Endpoint
Nightmare Eclipse says the Kaspersky Endpoint Security zero-day allows privilege escalation on a fully patched Windows 11 25H2 system running Kaspersky Endpoint v14.0.0.504.
organisation FalconFlank
The researcher named the exploit FalconFlank, it triggers a privilege escalation flaw.
organisation the Microsoft
“Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as “ShieldBreak ” reads Microsoft’s advisory.
infrastructure 1.1.26080
Version 1.1.26080.3 includes the fix, which requires no user action and does not affect systems with Microsoft Defender disabled.
organisation Microsoft Office
According to the researcher, FalconFlank abuses Falcon’s  “Microsoft Office file malicious macro removal”  feature.
organisation Falcon
According to the researcher, FalconFlank abuses Falcon’s  “Microsoft Office file malicious macro removal”  feature.
organisation DLL
The researcher pointed out that the PoC is unstable and may require repeated attempts, but when successful, it creates a DLL in System32 with full user permissions.
organisation Kaspersky
The researcher also claims taking control of Kaspersky’s UI process can disrupt the antivirus and interfere with file-access controls, potentially leaving the system in an unstable state.
organisation GenDigital Avast Antivirus
The researcher also released a zero-day exploit targeting GenDigital Avast Antivirus, named  PrettyPrague .
organisation AVG
The researcher also suspects the flaw may affect other Gen Digital products, including AVG and Norton.
organisation Norton
The researcher also suspects the flaw may affect other Gen Digital products, including AVG and Norton.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, ShieldCrash)
‎2026/09/09
Threat actors released ShieldCrash, a proof of concept (PoC) for Microsoft Defender's zero-day vulnerability.
organisation BleepingComputer
A Microsoft spokesperson was not immediately available to comment when BleepingComputer reached out earlier today about the ShieldCrash zero-day. !
‎2003 - 2026
Threat actors used a previously unknown exploit in Microsoft Defender to release ShieldCrash, a proof of concept (PoC) for the vulnerability.
organisation Social & Feeds
* Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved []( "Back to Top")
‎2026/09/09
ShieldCrash is a proof-of-concept exploit for Microsoft Defender's zero-day vulnerability ShieldBreak CVE-2026-69414.
organisation ShieldBreak Defender
ShieldCrash is described as a bypass for the ShieldBreak Defender privilege escalation flaw patched on Thursday, which itself bypassed RoguePlanet, another Defender flaw disclosed in June and patched by Microsoft in July.
organisation RoguePlanet
ShieldCrash is described as a bypass for the ShieldBreak Defender privilege escalation flaw patched on Thursday, which itself bypassed RoguePlanet, another Defender flaw disclosed in June and patched by Microsoft in July.
infrastructure Windows
[Image 11: How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11]( * !
[Image 12: How to use the Windows Registry Editor How to use the Windows Registry Editor]( * !
[Image 13: How to backup and restore the Windows Registry How to backup and restore the Windows Registry]( * !
[Image 14: How to start Windows in Safe Mode How to start Windows in Safe Mode]( * !
[Image 16: How to show hidden files in Windows 7 How to show hidden files in Windows 7]( * !
[Image 17: How to see hidden files in Windows How to see hidden files in Windows]( * Webinars * Downloads * Latest * Most Downloaded * !
According to Nightmare Eclipse, the ShieldCrash proof-of-concept exploit lets attackers gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems, but will not give them write access to the compromised systems.
Since April, the anonymous security researcher has disclosed a long string of zero-day flaws, including the ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend zero-days targeting Microsoft Defender, BitLocker, and other Windows components.
Get the report ### Related Articles: Microsoft working on Defender patch for ShieldBreak zero-day New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges Microsoft patches RoguePlanet Defender zero-day vulnerability Windows LegacyHive zero-day flaw gets free, unofficial patches Microsoft patches LegacyHive Windows zero-day vulnerability * Bypass * Elevation of Privileges * Microsoft * Microsoft Defender * Nightmare Eclipse *
organisation Stack Protection
[Image 11: How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11]( * !
organisation Windows Registry
[Image 12: How to use the Windows Registry Editor How to use the Windows Registry Editor]( * !
organisation the Windows Registry
[Image 13: How to backup and restore the Windows Registry How to backup and restore the Windows Registry]( * !
organisation LegacyHive
Since April, the anonymous security researcher has disclosed a long string of zero-day flaws, including the ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend zero-days targeting Microsoft Defender, BitLocker, and other Windows components.
organisation BlueHammer
Since April, the anonymous security researcher has disclosed a long string of zero-day flaws, including the ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend zero-days targeting Microsoft Defender, BitLocker, and other Windows components.
organisation RedSun
Since April, the anonymous security researcher has disclosed a long string of zero-day flaws, including the ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend zero-days targeting Microsoft Defender, BitLocker, and other Windows components.
organisation YellowKey
Since April, the anonymous security researcher has disclosed a long string of zero-day flaws, including the ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend zero-days targeting Microsoft Defender, BitLocker, and other Windows components.
organisation GreenPlasma
Since April, the anonymous security researcher has disclosed a long string of zero-day flaws, including the ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend zero-days targeting Microsoft Defender, BitLocker, and other Windows components.
organisation MiniPlasma
Since April, the anonymous security researcher has disclosed a long string of zero-day flaws, including the ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend zero-days targeting Microsoft Defender, BitLocker, and other Windows components.
organisation BitLocker
Since April, the anonymous security researcher has disclosed a long string of zero-day flaws, including the ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend zero-days targeting Microsoft Defender, BitLocker, and other Windows components.
organisation ShieldBreak
1/1 Skip Ad Continue watching after the ad!Image 36: Loading PodsVisit Advertiser websiteGO TO PAGE Video 1 Video 2 Video 3 Video 4 Video 5 Video 6 Video 7 "Microsoft has failed to properly patch ShieldBreak CVE-2026-69414, under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak.
organisation ShieldCrash
Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day.
New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access.
organisation PoC
Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day.
organisation Microsoft Defender
Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day.
infrastructure Microsoft 365
Microsoft 365 phishing BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations]( * !
organisation BigBear Microsoft 365
Microsoft 365 phishing BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations]( * !
organisation MFA
Microsoft 365 phishing BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations]( * !
victims 258 organizations
Microsoft 365 phishing BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations]( * !
organisation Unicode
[Image 43: Phishing Attackers conceal phishing lures using invisible Unicode characters]( S ponsor Posts * !
organisation EU CRA
Check your EU CRA readiness in 5 questions.
organisation Magento
[Image 3: Adobe fixes critical Magento zero-day exploited to backdoor servers Adobe fixes critical Magento zero-day exploited to backdoor servers]( * !
organisation Adobe
[Image 3: Adobe fixes critical Magento zero-day exploited to backdoor servers Adobe fixes critical Magento zero-day exploited to backdoor servers]( * !
threat_actor ShinyHunters
[Image 4: ShinyHunters hackers claim breach of Florida ShinyHunters hackers claim breach of Florida "DAVID" DMV database]( * !
organisation DMV
[Image 4: ShinyHunters hackers claim breach of Florida ShinyHunters hackers claim breach of Florida "DAVID" DMV database]( * !
organisation New Microsoft Defender '
[Image 6: New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access]( * !
organisation Google
[Image 7: Google warns of new Chrome zero-day bug exploited in attacks Google warns of new Chrome zero-day bug exploited in attacks]( * !
organisation DoppelCart
[Image 9: DoppelCart fraud network uses 119,000 fake shops to steal credit cards DoppelCart fraud network uses 119,000 fake shops to steal credit cards]
organisation IP
[Image 31: How to change IP address.jpg) How to change IP address]( * !
organisation safely.jpg
Access the dark web safely.jpg)
organisation The Blue Report 2026
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
organisation CTI
[Image 45: CTI Starter Kit + 2026 SANS CTI Survey CTI Starter Kit + 2026 SANS CTI Survey]( * !
organisation Upcoming Webinar
[Image 39: ThreatLocker]( Upcoming Webinar !
organisation Astra
[Image 42: ChatGPT ChatGPT Astra is now rolling out to $20 Plus subscription]( * !
financial $20 $ subscription
[Image 42: ChatGPT ChatGPT Astra is now rolling out to $20 Plus subscription]( * !
organisation Freestar.com
Image 50!Image 51!Image 52!Image 53!Image 54!Image 55!Image 56!Image 57!Image 58!Image 59!Image 60!Image 61 Freestar.com !
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
Nightmare Eclipse says the Kaspersky Endpoint Security zero-day allows privilege escalation on a fully patched Windows 11 25H2 system running Kaspersky Endpoint v14.0.0.504.
The researcher published a proof of concept (PoC) that can read arbitrary files with SYSTEM privileges, the highest level of access on Windows.
He says all supported Windows versions remain vulnerable, even after the September 2026 security updates.
“This PoC demonstrates an arbitrary file read as SYSTEM with September 2026, all supported windows versions are affected.”
The PoC exploits a flaw in Avast Sandbox to dump the Windows SAM database and gain a SYSTEM-level shell.
It reportedly works even on fully patched Avast Antivirus and Windows 11 25H2.
His releases have mainly targeted Microsoft products, including Windows and Microsoft Defender, with some later exploited in the wild.
[Image 5: August updates trigger 0xc0000409 errors on Windows Server 2016 August updates trigger 0xc0000409 errors on Windows Server 2016]( * !
[Image 11: How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11]( * !
[Image 12: How to use the Windows Registry Editor How to use the Windows Registry Editor]( * !
[Image 13: How to backup and restore the Windows Registry How to backup and restore the Windows Registry]( * !
[Image 14: How to start Windows in Safe Mode How to start Windows in Safe Mode]( * !
[Image 16: How to show hidden files in Windows 7 How to show hidden files in Windows 7]( * !
[Image 17: How to see hidden files in Windows How to see hidden files in Windows]( * Webinars * Downloads * Latest * Most Downloaded * !
According to Nightmare Eclipse, the ShieldCrash proof-of-concept exploit lets attackers gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems, but will not give them write access to the compromised systems.
"This PoC demonstrates an arbitrary file read as SYSTEM with September 2026, all supported windows versions are affected.
Since April, the anonymous security researcher has disclosed a long string of zero-day flaws, including the ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend zero-days targeting Microsoft Defender, BitLocker, and other Windows components.
Get the report ### Related Articles: Microsoft working on Defender patch for ShieldBreak zero-day New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges Microsoft patches RoguePlanet Defender zero-day vulnerability Windows LegacyHive zero-day flaw gets free, unofficial patches Microsoft patches LegacyHive Windows zero-day vulnerability * Bypass * Elevation of Privileges * Microsoft * Microsoft Defender * Nightmare Eclipse *
Metrics
infrastructure
‎1.1.26080
Software Version
Version 1.1.26080.3 includes the fix, which requires no user action and does not affect systems with Microsoft Defender disabled.
Metrics
infrastructure
‎Microsoft Office
Affected Product
According to the researcher, FalconFlank abuses Falcon’s  “Microsoft Office file malicious macro removal”  feature.
Metrics
infrastructure
‎Microsoft 365
Affected Product
Microsoft 365 phishing BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations]( * !
Metrics
victims
258
Organizations
Microsoft 365 phishing BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations]( * !
Metrics
infrastructure
2,016
Windows Server
[Image 5: August updates trigger 0xc0000409 errors on Windows Server 2016 August updates trigger 0xc0000409 errors on Windows Server 2016]( * !
Metrics
data_breach
0
September
[Image 34: ThreatLocker]( * Home * News * Security * New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access # New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access By ###### Sergiu Gatlan * September 9, 2026 * 03:30 AM * 0 !
Metrics
financial
20
$ Subscription
[Image 42: ChatGPT ChatGPT Astra is now rolling out to $20 Plus subscription]( * !
Intelligence Sources
Security Affairs 2026-09-09
BleepingComputer 2026-09-09