Vulnerabilities & Exploits · Zero-Day Exploit

Defender flaw now has a PoC and federal clock

Qualys says ShieldBreak, tracked as CVE-2026-69414, now has a public proof of concept and no Microsoft patch yet, while CISA Binding Operational Directive 26-04 gives federal agencies 14 days to act. The flaw sits in the Microsoft Malware Protection Engine used by Microsoft Defender and lets a low-privilege local user climb to SYSTEM.

The trick is that Defender does privileged scanning work on content an attacker can influence. If the engine processes attacker-controlled input in that high-rights path, the scan itself becomes the jump point from a normal account to full local system rights, which is why waiting for the vendor fix is not the whole response.

For Windows estates that rely on Defender as a control, the exposure lives inside the protection stack itself: a local foothold can turn the security product into the escalation path, and any endpoint trust that assumes Defender is a boundary becomes weaker until the patch lands.

7 sources · Aug 25

CVE-2026-69414

NVD KEV

CVSS 7.8 HIGH: microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender… EPSS 1% (70th percentile), up from 0.3%. Microsoft patch: Release Notes.

Timeline

Sources

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-08-25

Every edition of this story: Defender flaw now has a PoC and federal clock

More from today