New Windows vulnerability gives hackers system-wide access to user's device
What's the story
A new zero-day vulnerability, dubbed ShieldBreak, has been discovered in the latest versions of Windows. The bug allows hackers to gain system-wide access to a user's device and data. The security researcher Nightmare Eclipse revealed the flaw despite facing legal threats from Microsoft weeks earlier over previously undisclosed software bugs.
Attack vector
ShieldBreak exploits Windows Defender
The ShieldBreak vulnerability exploits a flaw in Windows Defender, the built-in anti-malware and security engine of Windows.
A successful attack can let a hacker escalate their permissions from a low-level user to full access to the device and its data.
The researcher has published proof-of-concept exploit as a Windows app, which needs to be run by the user for exploiting this bug.
Impact scope
Affects multiple versions of Windows
Nightmare Eclipse has confirmed that the ShieldBreak vulnerability affects Windows 10, Windows 11 (including the latest 25H2 version), and Windows Server 2025.
Security researcher Will Dormann has also verified that the bug works and requires Windows Defender to be enabled for the exploit to work.
This broad impact highlights a serious security risk for users across different platforms.
Exploit evolution
Evolution from earlier exploit RoguePlanet
The latest exploit, ShieldBreak, is an evolution of an earlier one called RoguePlanet.
Microsoft had patched RoguePlanet but Nightmare Eclipse implied that the fix was not enough and their new exploit shows a full bypass of the previous patch.
This development highlights the ongoing cat-and-mouse game between security researchers and software companies in addressing vulnerabilities effectively.
Patch status
Patch not yet available for ShieldBreak bug
As of now, Microsoft has not issued a patch for the ShieldBreak bug.
The company was given no time to fix this vulnerability before it was publicly disclosed, which is why it is considered a zero-day.
This latest disclosure adds to the ongoing debate between Nightmare Eclipse and Microsoft over how the latter handles bug reports from security researchers.