A security researcher has published a proof-of-concept exploit for a Microsoft zero-day called ShieldBreak that fully bypasses a recent Microsoft Defender patch, while North Korea’s Lazarus Group has been caught exploiting a separate actively exploited Windows privilege escalation flaw in the wild.
The combined disclosures arrived alongside Microsoft’s August 2026 Patch Tuesday release, which addressed 398 CVEs including 42 critical-severity flaws, underscoring the intensity of the current threat landscape facing Windows users and enterprise defenders.
ShieldBreak Bypasses RoguePlanet Patch
Security researcher Chaotic Eclipse published the ShieldBreak proof-of-concept on August 11, claiming it achieves a complete bypass for CVE-2026-50656, a vulnerability dubbed RoguePlanet that Microsoft patched in July. RoguePlanet was a race condition in the Microsoft Malware Protection Engine that could grant an attacker a shell with SYSTEM-level privileges, enabling arbitrary code execution.
Microsoft first patched RoguePlanet on July 15 after the researcher disclosed it in June, but the researcher now claims the defense-in-depth updates Microsoft introduced to address the flaw are insufficient. The ShieldBreak PoC, tested on Windows 11 25H2 and Windows Server 2025, reportedly achieves a 100% success rate and requires Microsoft Defender to be active in order to work.
Independent security researchers Kevin Beaumont and Will Dormann validated the exploit. Beaumont confirmed it works on Windows 11, noting that ShieldBreak uses a user-mode callback hook to change file contents during a Defender cloud-hydration scan via the Cloud Filter API, while RoguePlanet relied on a filesystem race condition involving virtual disks.
Lazarus Exploits CVE-2026-68820
In a separate advisory, Microsoft confirmed that CVE-2026-68820, a Windows Ancillary Function Driver for WinSock elevation of privilege vulnerability, is being actively exploited in the wild. The flaw, which carries a CVSS score of 7.0 and was credited to Check Point researchers, allows an authorized attacker to escalate privileges locally, granting SYSTEM-level access.
The vulnerability has been linked to North Korea’s Lazarus Group and its “Operation Dream Job” campaign, which targets defense, aerospace, and cryptocurrency organizations through recruitment-themed lures. CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog on August 11, giving federal agencies a deadline of August 25 to apply the fix.
Microsoft has assigned the ShieldBreak vulnerability CVE-2026-69414 with a CVSS score of 7.8 and an exploitability assessment of “Exploitation More Likely.” The company said it is working to provide a security update addressing the flaw. The August Patch Tuesday release also patched a third researcher-disclosed zero-day, CVE-2026-62832, a Windows User Profile Service privilege escalation issue called LegacyHive.
Sources: The Hacker News; Rapid7; Microsoft MSRC; CISA; SecurityWeek
discussion