Microsoft Defender Malware Protection Engine 'RoguePlanet' link-following LPE to SYSTEM - now fixed (engine >=1.1.26060.3008); NCSC-CH Nightmare Eclipse tracker

The original entry recorded that no patch existed, no vendor had publicly reproduced the ShieldBreak proof-of-concept, and Microsoft had not commented. Two of those three have changed. Microsoft published an advisory on 2026-08-14 that names the technique directly (the vulnerability is described as an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak") and assigned it CVE-2026-69414 (Microsoft, 2026-08-14). The third has not: on the fix, Microsoft states only that "We are working to provide a high quality security update that addresses this vulnerability."

The vendor's own calibration is the useful part of the delta. Microsoft rates the flaw Important with a CVSS 3.1 base score of 7.8 for a local, low-privilege, no-interaction elevation, records it as publicly disclosed, records exploitation as not detected, and sets its exploitability assessment to "Exploitation More Likely" (Microsoft, 2026-08-14). That combination (publicly available exploit code, a vendor expectation of exploitation, and no update) is the shape that justifies attention outside the normal patch cycle, and it is a materially different footing from a researcher's unverified GitHub claim.

The relay is what brought it into this constituency's field of view. Switzerland's NCSC amended its rolling Nightmare Eclipse advisory on 2026-08-17 to record that "ShieldBreak is tracked as CVE-2026-69414 by Microsoft" (NCSC-CH, 2026-08-17), and CERT-FR issued advisory CERTFR-2026-AVI-1035 the same day, listing the Microsoft Malware Protection Engine among affected systems alongside an unrelated, already-patched PowerShell flaw (CERT-FR, 2026-08-17). CERT-FR's bulletin carries its standard instruction to consult the vendor advisory for fixes; for this CVE that advisory has none to offer, which is worth knowing before an operator treats the bulletin as a patchable item.

Detection, telemetry class first. No new behavioural detail was published with the CVE, so nothing here supersedes what the original entry carried. The durable anchor remains process-creation telemetry with parent lineage: the Malware Protection Engine has no legitimate reason to be the parent of an interactive shell or an unexpected child process, so any such process tree rooted at the engine is the signal irrespective of which variant produced it. Triage: the engine's own remediation work (quarantine, deletion, signature updates) runs inside the service rather than by launching command interpreters, so a shell parented to it does not have a benign counterpart; the discriminator is the parent-child relationship itself, not the child's command line.

This pipeline recorded CVE-2026-69414 three days ago as acknowledged by Microsoft, rated 7.8, publicly disclosed, assessed "Exploitation More Likely", with a security update still being worked on. Two things have changed and neither is a fix.

It works on the current patch level, and that is now independently established. "The LevelBlue OpsCTI and THOR teams reviewed and reproduced the complete ShieldBreak exploitation chain with the August 2026 Patch Tuesday updates installed, confirming the PoC functions as described" (LevelBlue SpiderLabs, 2026-08-19). LevelBlue reports the chain running to SYSTEM from a standard user account on Windows 11 24H2 and Windows Server 2025 with Defender in its default configuration, self-contained and needing no arguments, completing in roughly eight to twelve seconds on an idle system. Queried directly, Microsoft's own record for the CVE shows its most recent revision dated the same day as that report, and the change it describes is the addition of a CWE classification, informational only (MSRC, 2026-08-19), exploitation still recorded as no, the exploitability assessment unchanged, and the temporal metrics still recording proof-of-concept code available with no official fix.

The mechanism, which is the substance of the delta. The prior entry had the identifier and Microsoft's rating but not how the chain works. LevelBlue reconstructs it in seven stages, and the elegant part is that the attacker never writes to System32; Defender does.

The exploit first raises its own process and thread priority to improve its odds in a later race, then registers a fake Cloud Files sync provider rooted at a working directory it creates, and creates a placeholder file so Windows treats it as a cloud-resident object not yet downloaded. Its hydration callback is two-faced by design: the first read returns a benign archive, which is what Defender detects; a later read returns the malicious DLL, which is what ends up on disk. Next it resolves native object-manager routines out of ntdll.dll and builds a shadow namespace containing two conflicting symbolic links under the same name (one pointing at the working directory, one at a transaction-log path) giving it a redirection layer that sits above the filesystem. It then loads Defender's own management library directly and resolves that library's scan and clean functions to open Defender's RPC interface, scan the placeholder through the shadow path, and (once Defender has flagged the bait archive) start Defender's own remediation operation against it. A time-of-check-to-time-of-use race, held open with an exclusive lock on a transaction-log file while the symbolic link is swapped underneath, redirects that remediation so Defender's clean engine writes the attacker's DLL into System32. Execution as SYSTEM then comes from a Windows Error Reporting scheduled task loading that DLL through the error-reporting host process.

LevelBlue also places the disclosing persona in a lineage of prior proof-of-concept releases and notes a functional improvement over the immediately preceding one: where the earlier LegacyHive technique needed a helper-account logon to trigger its final stage, ShieldBreak is fully self-contained.

Triage: LevelBlue's own framing is the right instruction; "ShieldBreak is best detected through behavioral correlation rather than any single static indicator", because every component is a legitimate Windows capability. The highest-value single signal is a module load: Defender's management library being loaded by a process outside the small, stable set of Defender's own binaries, especially when that same process then resolves Defender's scan and clean entry points at runtime. Around it, two more composites: an unapproved process registering a cloud sync root and creating a placeholder, then immediately moving into object-manager and Defender API activity; and a standard-user process taking an exclusive lock on a transaction-log file. Each is weak alone (legitimate sync agents register sync roots, and Defender's own processes load its library all day) so the sequence and the identity of the calling process are what separate them. The final stage is the most conventional: a DLL appearing in System32 followed by the error-reporting scheduled task being run on demand, with the payload cleaned up afterwards.

The entry this one updates recorded that Microsoft had acknowledged ShieldBreak as CVE-2026-69414, rated it 7.8, assessed it "Exploitation More Likely", and stated a security update was still being worked on, with no published mechanism and therefore nothing to detect on. LevelBlue SpiderLabs has now published the mechanism and, with it, a hunting package (LevelBlue SpiderLabs, 2026-08-19). That is the whole delta, and at the time it mattered because no fix existed: detection was then the only control a defender had. (Microsoft has since shipped an engine fix, see the 2026-09-13 update below.)

The chain turns Windows Defender's own remediation path into the write primitive. The proof-of-concept registers its working directory as a Cloud Files sync root, self-identifying as a sync provider with a hardcoded provider GUID and creating a placeholder file. It then creates two directories beneath the object manager's \BaseNamedObjects\Restricted\ namespace and, inside them, two conflicting symbolic links both named WD_SCAN, one initially resolving to the working directory holding the placeholder, the other to a path used by the Common Log File System. It opens Defender's interface directly, resolving the management, scanning and clean functions out of MpClient.dll at runtime, and asks Defender to scan the placeholder through a \\.\globalroot\...\WD_SCAN\ path. A background thread watches for the CLFS transaction log that Defender's clean operation creates, and the instant it appears takes an exclusive lock on it, freezing Defender mid-transaction. With the operation held open, the proof-of-concept deletes the shadow WD_SCAN link and recreates it pointing at \??\UNC\127.0.0.1\C$\Windows\System32\phoneinfo.dll, so the already-in-flight path resolves somewhere new without any NTFS junction being involved; it then restarts Cloud Files hydration with the file size set to the DLL's rather than the original's, so the hydration callback supplies the attacker's bytes while Defender's clean engine performs the write. Because MsMpEng.exe is the process that writes the file, the write itself looks expected, which LevelBlue flags as a triage detail that must be correlated rather than dismissed. The proof-of-concept then maps the resulting DLL as an executable image to stop remediation removing it, crafts a Windows Error Report into the report queue, and triggers the built-in QueueReporting scheduled task through the Task Scheduler COM interface method ITaskService::Run(); that task runs as SYSTEM, so the signed Windows error-reporting binary wermgr.exe processes the report and loads phoneinfo.dll with SYSTEM privileges, a trusted system binary acting as the proxy that executes the attacker's code, which is how the payload runs without the attacker ever launching a process of their own. LevelBlue states the whole sequence takes approximately eight to twelve seconds on an unloaded system, and that it "is fully self-contained and runs to full SYSTEM completion from a standard user account on any fully patched Windows 11 24H2 or Windows Server 2025 system with Windows Defender in its default configuration."

Detection, in the report's own framing, "is best detected through behavioral correlation rather than any single static indicator", but one static indicator is close to free. LevelBlue identifies C:\Windows\System32\phoneinfo.dll as the strongest single indicator in the chain and states the file is not expected to exist natively on supported Windows versions, so its creation warrants a high-priority look regardless of the process that wrote it. (The hedge is the source's own and is worth keeping: "not expected on supported versions" is what it will bear, not a guarantee about every Windows build ever shipped.) Beyond that, and led by telemetry class: in image- and module-load telemetry, MpClient.dll loaded by a process that is not one of Defender's own small set of expected consumers (the report names MsMpEng.exe, MpCmdRun.exe, NisSrv.exe, ConfigSecurityPolicy.exe and MpSigStub.exe) is the compound signal, and LevelBlue is specific about what makes it load-bearing: "The set of expected MpClient.dll consumers is small. A load by an unrelated process becomes especially significant when followed by runtime resolution of MpManagerOpen, MpScanStart, MpCleanOpen, MpCleanStart, or MpCleanControl." The same telemetry should surface wermgr.exe loading phoneinfo.dll. In scheduled-task audit records, the QueueReporting task being started programmatically through the Task Scheduler COM interface is the execution step. In registry or filter telemetry, a sync-root registration call issued by a process that is not a cloud-sync client is the setup step. And in named-pipe telemetry this specific proof-of-concept creates a pipe with a hardcoded name, with a SYSTEM-integrity process then connecting to a pipe a normal user created, though that name is an artefact of this build rather than of the technique.

Triage: every individual event here has a benign twin, which is why the sequence is the detection. MsMpEng.exe writing into System32 is normal remediation behaviour; a cloud-sync provider registering a sync root is normal on a machine running OneDrive or a similar client; wermgr.exe running as SYSTEM off a scheduled task is normal error reporting. The discriminators are the process identities and the ordering: a sync-root registration from something that is not a sync client, MpClient.dll resolved by a non-Defender process followed by that specific clean-function set, and a QueueReporting run driven through COM rather than by the ordinary error-reporting trigger, with the whole chain completing inside roughly ten seconds. Hardening was the awkward part while the flaw was unpatched: because the abused component is Defender itself in its default configuration, there was no configuration change to apply, and the vulnerable-driver blocklist and application-control policies have nothing third-party to key on. Microsoft has since shipped an engine fix, so updating the Defender engine is now the primary control, see the 2026-09-13 update below.

Microsoft has shipped a fix, and this entry's standing "no fix available" status was stale. Microsoft's own record for CVE-2026-69414 now carries a remediation boundary in its structured fields: "Last version of the Microsoft Malware Protection Engine affected by this vulnerability" reads 1.26070.7, and "First version of the Microsoft Malware Protection Engine with this vulnerability addressed" reads 1.1.26080.3 (Microsoft MSRC, latest revision 2026-09-03). The record's CVSS vector carries RL:O (an official fix) against the E:P proof-of-concept maturity it already had. The practical point for a defender is that the Defender engine version updates on its own cadence and is not the same thing as the OS patch level, so an estate that is fully current on Windows Update is not thereby on engine 1.1.26080.3; check the engine version explicitly. That replaces detection-as-the-only-control, which is what this entry has told readers since 2026-08-12.

The same researcher now claims the fix is incomplete, as their own claim, not a confirmed one. On 2026-09-08 Nightmare Eclipse published ShieldCrash, described in the researcher's own repository as a partial rather than total bypass: "Microsoft has failed to properly patch ShieldBreak CVE-2026-69414, under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak. While Microsoft fixed several things to prevent re-exploiting the issue, they missed a spot where ShieldBreak can still be exploited" (Nightmare Eclipse, 2026-09-08). What is published is explicitly unfinished and narrower than the original: SOCRadar records that "ShieldCrash does not currently have a separate CVE. Nightmare Eclipse describes the public release as a skeleton PoC that demonstrates privileged file reads. It does not establish arbitrary file writes or SYSTEM-level code execution" (SOCRadar, 2026-09-10), and that "Microsoft has not publicly confirmed the reported bypass" (SOCRadar, 2026-09-10). Microsoft's record predates the ShieldCrash release by five days and acknowledges no bypass. SOCRadar also states there is no confirmed in-the-wild exploitation of ShieldCrash.