Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed
A security researcher, Chaotic Eclipse, has demonstrated a method to bypass a patch for a vulnerability (ShieldBreak) in Microsoft Defender, highlighting a gap in Microsoft's patching process. This allows for an arbitrary file read with SYSTEM privileges, potentially enabling attackers to exploit the Defender system. Microsoft has addressed the issue with a patch, but the PoC underscores the ongoing need for vigilance and timely updates.
A security researcher, Chaotic Eclipse, has released a proof-of-concept (PoC) demonstrating a method to bypass a patch for a vulnerability (ShieldBreak) within Microsoft Defender. This vulnerability, identified as CVE-2026-69414, allows an attacker to trigger the same problem that was previously caused by ShieldBreak. The researcher reported this issue last month, noting that Microsoft has failed to adequately address the underlying issue despite shipping an update to the Microsoft Malware Protection Engine.
Microsoft has addressed the vulnerability with a patch, specifically in Malware Protection Engine version 1.1.26080.3. This patch does not require any action from users and will not affect systems where Microsoft Defender is disabled. The vulnerability allows for an arbitrary file read with SYSTEM privileges, a significant security risk.
Microsoft stated that it frequently updates malware definitions and the Microsoft Malware Protection Engine in response to a constantly changing threat landscape, emphasizing the importance of keeping antimalware software up to date. They also highlight that the default configuration in Microsoft antimalware software ensures automatic updates for both enterprise and end-user deployments.
Chaotic Eclipse has previously released PoC exploits for vulnerabilities affecting CrowdStrike Falcon Sensor (FalconFlank), Kaspersky (HardBreacher), Avast Antivirus (PrettyPrague), and NVIDIA (GreenSection). Both HardBreacher and PrettyPrague have since been patched by their respective vendors, while CrowdStrike is currently investigating the report related to FalconFlank.