New Windows zero-day grants system privileges on patched systems

What happened?

Security researcher known as Nightmare Eclipse has published a new local privilege escalation exploit called ShieldBreak. According to its description, it allows an attacker to gain SYSTEM privileges on fully patched Windows systems, including Windows 10, Windows 11 25H2, and Windows Server 2025. The researcher claims the exploit has a 100% success rate and also affects Windows 10, though he does not provide support for that version in his PoC.

The announcement came just hours after Microsoft's August Patch Tuesday, which fixed 421 vulnerabilities but did not include a patch for this new flaw. Nightmare Eclipse claims that ShieldBreak is a bypass of the patch for the RoguePlanet vulnerability (CVE-2026-50656), fixed in July. However, renowned security expert Kevin Beaumont, a former Microsoft employee, has pointed out that the two flaws operate differently: while RoguePlanet was a race condition in the file system, ShieldBreak uses a user-mode callback hook to modify files during a Defender cloud hydration scan via the Cloud Filter API (cfapi).

Beaumont has confirmed that he has tested the exploit and that it works on the latest version of Windows 11, and has published detections and hunting queries to help defenders identify potential threats. Microsoft has not officially responded about when it plans to patch this vulnerability.

Why is it important?

This zero-day is significant for several reasons. First, it affects fully patched systems, demonstrating that even the latest updates are not enough to protect against such attacks. Second, it is the tenth zero-day published by Nightmare Eclipse since April, indicating a sustained campaign against Microsoft. Third, independent confirmation by Kevin Beaumont adds credibility to the exploitability, increasing the urgency for organizations to implement mitigations.

Escalation to SYSTEM privileges is critical because it allows an attacker to take full control of the machine, install malware, steal credentials, and move laterally across the network. In an enterprise environment, this could compromise sensitive data and cause severe damage.

What will be the consequences?

Immediate consequences include an increased risk of targeted and untargeted attacks. Cybercriminals could leverage this exploit in ransomware or espionage campaigns. Additionally, the lack of an official patch forces administrators to rely on interim measures, such as the detection queries published by Beaumont.

In the long term, this situation reflects a growing tension between security researchers and Microsoft. Nightmare Eclipse's aggressive disclosure strategy, publishing exploits without patches, has sparked debate about the ethics of responsible disclosure. Microsoft, which initially threatened legal action, backed down amid community criticism.

For businesses, this underscores the importance of adopting a defense-in-depth approach, including continuous monitoring, network segmentation, and least-privilege policies.

What should readers know?

System administrators should stay alert for Microsoft updates and apply security patches as soon as they become available. In the meantime, they should implement the detection queries provided by Kevin Beaumont to identify potential compromises. It is also advisable to limit the use of accounts with elevated privileges and use security tools that detect anomalous behavior.

It is important to note that although the exploit has been confirmed in test environments, there is no public evidence that it is being actively used in attacks. However, the rapid publication of functional exploits by Nightmare Eclipse increases the likelihood that cybercriminals will integrate it into their toolkits.

In summary, this zero-day is a reminder that security is not a static state, but a continuous process of evaluation and adaptation.