"Microsoft has failed to properly patch ShieldBreak CVE-2026-69414," Chaotic Eclipse said.
Chaotic Eclipse's ShieldCrash PoC
The security researcher known as Chaotic Eclipse published a proof-of-concept (PoC) exploiting what they call ShieldCrash, a vulnerability assessed to be a patch bypass for CVE-2026-69414 (CVSS 7.8), also known as ShieldBreak. According to the researcher, Microsoft fixed several elements to prevent re-exploitation but "missed a spot where ShieldBreak can still be exploited." The PoC demonstrates an arbitrary file read executed with SYSTEM privileges on machines running the latest version of Windows, and Chaotic Eclipse stated that all supported desktop operating system versions are impacted.
ShieldBreak CVE-2026-69414 and Microsoft's response
Microsoft shipped an update to the Microsoft Malware Protection Engine days before the PoC was published, releasing a patch for CVE-2026-69414 in Malware Protection Engine version 1.1.26080.3. Microsoft told The Hacker News that the update "does not require any customer action and does not affect systems that have disabled Microsoft Defender." The company also provided a broader statement about update practices: "In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine," and it emphasized that antimalware products must be kept up to date. "Product documentation also recommends that products are configured for automatic updating," the company added.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTechnical impact: arbitrary file read as SYSTEM on supported Windows
Chaotic Eclipse's PoC focuses on achieving an arbitrary file read as the SYSTEM account, a high privilege level on Windows desktop systems. The researcher asserts this same problem — the one fixed by ShieldBreak — remains reachable "under specific conditions" despite Microsoft's earlier fixes. The source states the PoC works on "the latest version of Windows installed" and affects "all supported versions of the desktop operating system," indicating the issue is not limited to a single build or configuration.
Other recent PoCs from Chaotic Eclipse and vendor reactions
This release follows a string of recent PoC disclosures by Chaotic Eclipse. In recent weeks the researcher published exploits for vulnerabilities impacting CrowdStrike Falcon Sensor (FalconFlank), Kaspersky (HardBreacher), Avast Antivirus (PrettyPrague), and NVIDIA (GreenSection). According to the reporting, both HardBreacher and PrettyPrague have since been patched by the respective vendors. CrowdStrike told The Hacker News that it is investigating the FalconFlank report.
What this means for security teams, enterprise deployments, and adversaries
- Technologists and security teams: Teams will be watching whether the Microsoft Malware Protection Engine update (version 1.1.26080.3) fully addresses CVE-2026-69414 in light of Chaotic Eclipse's claim that a bypass remains. Even though Microsoft states the update "does not require any customer action," defenders are likely to validate versioning and monitor for follow-up fixes or mitigations that close the "missed spot" the researcher describes.
- Enterprise deployments and end users: Microsoft emphasized automatic updating and said the update does not require customer action. Enterprises that have disabled Microsoft Defender or blocked automatic engine updates will need to reconcile that configuration with Microsoft's guidance and the researcher's assertion that all supported desktop versions can be impacted.
- Adversaries and threat actors: The publication of a working PoC demonstrating an arbitrary SYSTEM file read lowers the technical barrier for exploitation in the wild, according to the facts Chaotic Eclipse published. The researcher’s prior releases of multiple PoCs make clear that public exploit code is part of the current disclosure pattern.
Bottom line: a patch is in the field, but questions remain
Microsoft has distributed an update to the Microsoft Malware Protection Engine identified as version 1.1.26080.3 for CVE-2026-69414 and states it does not require customer action. Chaotic Eclipse's PoC, however, asserts that the vendor's fixes did not close every avenue of exploitation and demonstrates an arbitrary file read as SYSTEM across supported Windows desktop versions. Whether Microsoft will issue a further correction that addresses the specific bypass the researcher has identified — or provide additional guidance to administrators — is the unresolved point left by these published facts.
Read the original report: Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed — The Hacker News
