ShieldCrash Defender Bypass: Revised PoC Reads Protected Files as SYSTEM on Patched Windows

Early coverage made it sound worse than the evidence showed. One independent lab found that the first release did not work at all. A second lab later reported that a revised version did. The useful story is in that gap, so here is what is confirmed, what is still only claimed, and what Windows admins should check.

What ShieldCrash is​

The researcher released ShieldCrash on September 8, 2026, hours after Microsoft shipped its September Patch Tuesday updates. BleepingComputer covered it on September 9. The researcher's message was blunt: "Microsoft has failed to properly patch ShieldBreak CVE-2026-69414." The researcher also claimed that "While Microsoft fixed several things to prevent re-exploiting the issue, they missed a spot where ShieldBreak can still be exploited."

The capability is narrower than many headlines suggested. eSecurity Planet noted that the current ShieldCrash demonstration is narrower than the earlier privilege-escalation flaw: it shows arbitrary file reads with SYSTEM privileges on fully patched systems but does not currently provide arbitrary writes or a SYSTEM shell. In the release notes, quoted by BleepingComputer, the researcher called the code a "skeleton" and said it might later become a full SYSTEM exploit.

A read-only primitive can still do real damage. A SYSTEM-level read can reach files an ordinary user can't open, including the SAM and SECURITY registry hives, which hold local account password hashes. Cyderes' Howler Cell team made this point after the researcher reclassified ShieldCrash a day later as a full privilege escalation and claimed the SAM database could be obtained easily. As Cyderes put it, an arbitrary SYSTEM file read is already a privilege escalation path once it can reach those hives. The researcher was describing the consequence of the claimed read, not announcing a second exploit.

Section summary: ShieldCrash claims a SYSTEM-context file read that survives the ShieldBreak fix. It is local-only, has no write capability and no shell, and was released as an unfinished "skeleton."

Three patches, three bypasses​

ShieldCrash is the latest step in a chain of fixes and bypasses in the same engine:

Cyderes describes the lineage this way: RoguePlanet (CVE-2026-50656) was patched in July 2026 through engine version 1.1.26060.3008. ShieldBreak (CVE-2026-69414) bypassed that patch in August and was itself patched in September 2026 through engine version 1.1.26080.3. ShieldCrash claims to bypass that fix and was published on September 8, 2026, the same day as September Patch Tuesday. All three target the Microsoft Malware Protection Engine, each through a different mechanism.

BetaNews adds a timing detail that matters. Microsoft patched the flaw through Malware Protection Engine version 1.1.26080.3, an automatic Defender update released September 3, five days before Patch Tuesday. Microsoft's advisory says the update needs no customer action and has no effect on systems where Defender is disabled. In other words, the ShieldBreak fix did not arrive in a Windows cumulative update. It came through Defender's own update channel, and that channel is where admins need to look.

On severity, The Hacker News reported ShieldBreak as CVE-2026-69414 (CVSS score: 7.8), and Hive Security's summary of Microsoft's CVE record also lists it as important-severity with a 7.8 score. CyberSecureFox disputes the number, arguing that the value of 7.8 that appears in some publications is not confirmed by the primary source. On exploitation, CyberSecureFox says Microsoft's advisory records public disclosure: yes, exploitation in the wild: no, with an "Exploitation More Likely" assessment. All of that applies to ShieldBreak, not to ShieldCrash.

The PoC that didn't work, then did​

Independent testing is what sets this episode apart from the usual zero-day news.

Round one: the original PoC failed. Cyderes Howler Cell ran the first release on Windows 11 25H2 (build 26200.9445) with Defender platform 4.18.26080.3, Malware Protection Engine 1.1.26080.3 and security intelligence 1.459.121.0. That engine build contains the ShieldBreak fix, so it was the right configuration for testing the bypass claim. Cyderes aimed the exploit at the SAM, SECURITY and ELAM hives. Every run produced an output file of exactly 2,505,480 bytes, which matched ntdll.dll on the test host. The SAM output's version resource identified itself as "NT Layer DLL."

Cyderes traced the problem to a basic implementation bug. During setup, the PoC copies ntdll.dll into an NTFS alternate data stream. Defender then writes a CLFS log file into the exploit's working directory. The PoC tries to delete that log while Defender still has it open, gets a sharing violation, and doesn't retry. Because the directory isn't empty, setting the reparse point fails with Windows error 145 (ERROR_DIR_NOT_EMPTY). The redirect never takes effect, and the exploit copies out its own planted ntdll.dll. A failed run therefore produces an output file that looks like a successful one. Cyderes found the same ntdll-sized output, about 2.5 MB where a small ELAM hive should be, in the researcher's own published screenshot.

LevelBlue SpiderLabs got the same result separately. Across fully patched Windows 11 and Windows Server builds, it ran the PoC against SAM, ELAM and a test file, and all three outputs hashed as ntdll.dll.

Neither lab said the underlying Defender behavior was safe. Cyderes stressed that the failure happened at a timing-sensitive housekeeping step, not at a security control. It rated the pipeline a viable exploitation target with moderate confidence.

Round two: the revised PoC worked. LevelBlue says the researcher released an updated PoC on September 15 and acknowledged in the same thread that the original was broken. On September 17, LevelBlue updated its analysis. On a fully patched VM, a standard user with no access to a protected test file ran the revised exploit and got a readable copy of it. LevelBlue then pulled the protected ELAM hive the same way and confirmed the output by its "regf" registry signature.

Both results can be true at once. Cyderes tested the first build and LevelBlue validated a later one. Hive Security noted in its September 24 update that the Cyderes result applies to the earlier version, not the revised one. LevelBlue's lab result still does not show that the exploit works on every supported Windows release, or that anyone has used it in an attack.

Section summary: The first ShieldCrash PoC gave back its own copy of ntdll.dll. LevelBlue reports that the revised PoC read protected files, including a registry hive, on a patched system.

Is there a fix yet?​

As far as the available reporting shows, no. When BleepingComputer asked, a Microsoft spokesperson was not immediately available to comment. In late September, Startup Fortune reported that Microsoft hasn't confirmed the bypass or issued a new CVE. Cyderes also noted that Microsoft had issued no ShieldCrash advisory or mitigation and had made no public comment. It added that in this lineage, Microsoft has usually acknowledged an issue and assigned a CVE within days of public release.

None of the sources we reviewed confirm the status as of mid-October, so treat it as unconfirmed. Defender engine fixes ship outside Patch Tuesday, so a quiet engine update is possible. Check the Security Update Guide and your engine versions rather than assuming either way.

Who is behind it, and why​

BleepingComputer reports that Nightmare Eclipse has released these exploits as part of an ongoing dispute with Microsoft over the company's bug bounty and vulnerability disclosure practices. Microsoft earlier warned of legal action against anyone engaged in "malicious activity causing real harm" to customers, and many read that as aimed at the researcher. Some outlets and social media posts describe the researcher as a disgruntled former Microsoft employee. That is speculation, not an established fact.

The track record is clearer. Cyderes counts ShieldCrash as the fifteenth tool from this researcher since April. Several earlier releases moved from proof of concept to real attacks: Cyderes notes that CISA added BlueHammer (CVE-2026-33825) to its Known Exploited Vulnerabilities catalog, and that BlueHammer, RedSun and UnDefend have all been confirmed exploited in the wild. The researcher has also moved on to third-party tools. Late-August and early-September releases targeted Kaspersky, Avast, CrowdStrike Falcon and NVIDIA's user-mode graphics components. For defenders, the pattern matters more than the personality: security software runs with high privileges, so a flaw in it is unusually valuable to an attacker.

What Windows admins should do now​

ShieldCrash is a local issue. Hive Security notes that none of these PoCs is a remote exploit. An attacker needs code already running on the machine. That means the risk is post-compromise privilege escalation, not drive-by infection.

1. Check the engine version, not just the OS patch level. In PowerShell, Get-MpComputerStatus returns AMEngineVersion and AMProductVersion. Engine 1.1.26080.3 is the minimum for the ShieldBreak fix. It is not a ShieldCrash fix, so deploy the newest engine Microsoft offers.
2. Keep Defender on. Microsoft says the ShieldBreak update has no effect where Defender is disabled. Turning off your antivirus to avoid an antivirus bug leaves the machine open to everything else.
3. Restrict local execution. Windows Defender Application Control or AppLocker rules that block unapproved executables and DLLs in user-writable locations reduce the number of footholds that could launch this exploit.
4. Hunt for behavior, not filenames. Cyderes and LevelBlue suggest watching for unknown software registering a Cloud Files sync root, MpClient.dll loading outside the Defender process tree, mount points targeting \BaseNamedObjects\Restricted, and symbolic links from that namespace to protected files such as SAM or ELAM. These are research-based leads, not validated detection rules.
5. Treat confirmed hive access as an incident. If telemetry shows SAM or SECURITY hive reads by an unexpected process, isolate the endpoint and rotate local credentials.
6. Don't run the PoC on a production PC. Hive Security warns that public exploit repositories can contain destructive binaries or later malicious changes.

Home users face limited risk, since an attacker needs a foothold first. Businesses are in a different position: for malware already on an endpoint, a working SYSTEM read is a way to escalate.

The takeaway​

Two Defender fixes in a row have been bypassed, and a third bypass has now been validated by at least one lab. Microsoft's quick, out-of-band engine updates are useful, but each fix has closed one path while the researcher keeps finding another. The first ShieldCrash release was buggy enough to fool its own author's screenshot, and a corrected version followed about a week later. Admins should check their Malware Protection Engine versions directly, because Windows Update status doesn't show them.