Microsoft Defender ShieldBreak bypass still lets attackers read files
Microsoft fixed a Defender flaw called ShieldBreak, but a researcher found another way to break past its security. Attackers can now read files on your PC with full system access, even after updates.
- Report priority
- High
- Targets
- Microsoft
How it works
- Microsoft patched ShieldBreak to stop attackers from breaking past Defender's security.
- But a researcher found a new way to exploit the same security boundary.
- Attackers send a specially crafted request to Defender, which lets them read any file on your PC with full system access.
- This does not yet let them write files or take full control, but it shows the security hole is not fully fixed.
What to do
If you use Windows with Microsoft Defender and have applied September's security updates, check if you see the ShieldCrash proof-of-concept in action. If you notice unexpected file access or unusual system behavior, watch for an official update from Microsoft or your antivirus provider. For now, this only lets attackers read files, not take full control.
In the meantime, avoid opening suspicious files or links, as attackers may still exploit this flaw to read sensitive data. If you suspect your files have been accessed, contact Microsoft Support for guidance.
Technical details
An attacker sends a malicious file to a victim's PC. When Defender scans it, the attacker's code bypasses Defender's security and reads sensitive files with full system access, even after updates.
Microsoft Defender's ShieldCrash vulnerability demonstrates a bypass of the September 2026 fix for ShieldBreak (CVE-2026-69414), allowing arbitrary file reads with SYSTEM privileges on fully patched systems. While it does not yet enable arbitrary writes or full SYSTEM shell access, the proof-of-concept suggests Microsoft's security boundary fix may remain incomplete. This follows a prior chain: RoguePlanet (CVE-2026-50656) was patched, then bypassed as ShieldBreak, now again bypassed as ShieldCrash. No CVSS score or CVE ID has been assigned to ShieldCrash.