CVE-2026-69414
published 2026-08-14CVE-2026-69414: Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
PriorityP344high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
1.32%
70.6th percentile
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_malware_protection_engine | >= 1.1.0.0 < 1.1.26080.3 | 1.1.26080.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
ghsa_unreviewed·2026-08-15
CVE-2026-69414 [HIGH] Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
We are working to provide a high quality security update that addresses this vulnerability. We will provide information in this CVE when the update is available.
VulDB
Microsoft Malware Protection Engine privileges management
vuldb·2026-08-15·CVSS 7.8
CVE-2026-69414 [HIGH] Microsoft Malware Protection Engine privileges management
A vulnerability identified as very critical has been detected in Microsoft Malware Protection Engine. The impacted element is an unknown function. This manipulation causes improper privilege management.
This vulnerability appears as CVE-2026-69414. The attack requires local access. There is no available exploit.
Applying a patch is the recommended action to fix this issue.
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
blogs_hackernews·2026-09-14
CVE-2026-85046 ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
AI keeps showing up in the wrong places. Attackers are using it to speed up exploits, test defenses, and automate more of the job. Some models are also crossing lines on their own. That is not a great combination.
The rest of the week is more familiar: old bugs still working, fresh exploit chains, exposed systems, weak defaults, and simple paths that should have been harder to abuse. A few of these stories are clever. Most are just easy.
Here’s what mattered this week.
## ⚡ Threat of the Week
OpenAI Agents Behind May 2026 Attack o
Hackernews
Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed
blogs_hackernews·2026-09-09·CVSS 7.8
CVE-2026-69414 [HIGH] Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed
The security researcher known as Chaotic Eclipse has dropped a proof-of-concept (PoC) for yet another zero-day in Microsoft Defender.
The vulnerability, codenamed ShieldCrash , is assessed to be a patch bypass for CVE-2026-69414 (CVSS score: 7.8), also called ShieldBreak , which the researcher reported last month.
"Microsoft has failed to properly patch ShieldBreak CVE-2026-69414," Chaotic Eclipse said. "Under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak. While Microsoft fixed se
Hackernews
Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon
blogs_hackernews·2026-09-03
CVE-2026-69414 Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon
The security researcher known as Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has dropped a new zero-day dubbed FalconFlank , a privilege escalation flaw impacting Crowdstrike Falcon.
"FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in CrowdStrike Falcon Sensor," the researcher said in a GitHub README file, adding the cybersecurity company may already have detections for the flaw by now.
"So if you want to test, you either have to add it to the exclusions or ob
Qualys
CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days
blogs_qualys·2026-08-25·CVSS 7.0
CVE-2026-69414 [HIGH] CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days
## Table of Contents
What Is ShieldBreak?
How ShieldBreak Turns Defender into a Privilege-Escalation Path?
Detecting CVE-2026-69414 with Qualys VMDR
Mitigating ShieldBreak Now Without the Microsoft Patch with TruRisk Eliminate
Bottom Line
Frequently Asked Questions (FAQs)
## Executive Summary
ShieldBreak (CVE-2026-69414) is a zero-day elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender, allowing a low-privilege local attacker to escalate to SYSTEM. A public PoC was released on August 12, 2026, and Microsoft assigned the CVE on August 14, and no patch is available yet. Qualys VMDR provides detection across Windows environments, and Qualys TruRisk Eliminate offers a mitigation that teams can apply now, with affected assets reasse
Qualys
CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days
blogs_qualys·2026-08-20·CVSS 7.0
CVE-2026-69414 [HIGH] CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days
## Table of Contents
What Is ShieldBreak?
How ShieldBreak Turns Defender into a Privilege-Escalation Path?
Detecting CVE-2026-69414 with Qualys VMDR
Mitigating ShieldBreak Now Without the Microsoft Patch with TruRisk Eliminate
Bottom Line
Frequently Asked Questions (FAQs)
## Executive Summary
ShieldBreak (CVE-2026-69414) is a zero-day elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender, allowing a low-privilege local attacker to escalate to SYSTEM. A public PoC was released on August 12, 2026, and Microsoft assigned the CVE on August 14, and no patch is available yet. Qualys VMDR provides detection across Windows environments, and Qualys TruRisk Eliminate offers a mitigation that teams can apply now, with affected assets reasse
Crowdstrike
September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs
blogs_crowdstrike
CVE-2026-81963 September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs
September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs Sep 08, 2026
CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks Sep 02, 2026
CrowdStrike Announces Agentic Identity Provider Sep 02, 2026
CrowdStrike Delivers the Next Evolution of the Agentic SOC Sep 02, 2026
September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs Sep 08, 2026
CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks Sep 02, 2026
CrowdStrike Announces Agentic Identity Provider Sep 02, 2026
CrowdStrike Delivers the Next Evolution of the Agentic SOC Sep 02, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Under
2026-08-14
Published