Security researcher known as Nightmare Eclipse has released an exploit for a zero-day vulnerability in Microsoft Defender, dubbed ShieldCrash. The exploit allows unauthorized access to read files with SYSTEM-level privileges on Windows systems that have received the latest September security updates.
ShieldCrash functions by bypassing a patch previously issued by Microsoft for another zero-day vulnerability, ShieldBreak (CVE-2026-69414). ShieldBreak itself was a workaround for a prior flaw identified by the same researcher, known as RoguePlanet (CVE-2026-50656), which Microsoft addressed in July.
While ShieldCrash enables file reading with SYSTEM rights, it does not currently support arbitrary data writing or shell execution. The researcher noted that the published exploit is a preliminary version, though it affects Windows 10, Windows 11, and Windows Server platforms.
This discovery marks the eleventh zero-day vulnerability disclosed by the researcher in Microsoft products. Recently, the expert also revealed a flaw named FalconFlank affecting the CrowdStrike Falcon platform, which targets functions designed to neutralize malicious Microsoft Office macros.
The researcher began publicizing these vulnerabilities after Microsoft allegedly blocked his access to their reporting portal. He claims the company ignored his initial warnings, leaving him no alternative but to disclose the security flaws publicly.
