Tech and AI
New Windows zero-day published months after legal threat
By Staff Writer | 13 August 2026
A researcher who was warned off by Microsoft in May has released a tenth unpatched flaw, this one giving full system access on current Windows. A second researcher says it works.
A previously unknown flaw in Windows Defender was published on 12 August, together with working proof-of-concept code. Named ShieldBreak by the researcher who released it, it is a local privilege escalation: a person or program with ordinary user rights on the machine can raise themselves to SYSTEM, the highest level Windows grants, and reach everything on the device.
The researcher says the code was tested on Windows 11 25H2 and Windows Server 2025 with a full success rate, and that Windows 10 and its server editions are vulnerable as well although not currently supported by the exploit. Windows Defender has to be enabled for the technique to work, which on a default installation it is. Microsoft has not issued a fix.
Two independent researchers have confirmed the exploit runs. One of them also published detection and hunting queries so defenders can look for it while there is no patch.
I've tried it, it works on latest Windows 11
Kevin Beaumont, security researcher and former Microsoft employee
A patch bypass, or something different
The researcher presents ShieldBreak as a bypass of the fix Microsoft issued in July for an earlier flaw of theirs, tracked as CVE-2026-50656. Beaumont disputes the characterisation while accepting the result. The earlier flaw, he wrote, was a filesystem race condition using virtual disks and low-level file manipulation to trick the quarantine process into overwriting system files. The new one hooks a user-mode callback to change file contents during a Defender cloud scan through the Cloud Filter API. Different mechanism, same destination.
Microsoft said it "is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims", and restated its support for coordinated disclosure, under which findings are investigated and addressed before publication.
The disclosure fight behind it
This is the tenth zero-day the same researcher has released against Microsoft products since starting in early April, and it landed within hours of the company's monthly patch release, which did not include it. Two earlier releases, one in July affecting the Windows user hives and one in June concerning a bypass of disk encryption through the recovery environment, are also without official patches. The earlier seven have been fixed.
The researcher has said in a series of posts that Microsoft mishandled their reports and that public release was the only route left. In May the company published a post threatening legal action against researchers who released zero-day details outside its disclosure policy. The security community reacted badly, with many describing similar experiences, and the company softened the position in a later social media post while leaving the original text up unchanged.
What to do in the meantime
There is no patch, so the only available measures are detective and preventive. The published hunting queries give security teams something to search their logs with. Beyond that the usual controls apply and matter more than usual: restrict who can run arbitrary executables, since the proof of concept is delivered as an application the user must run, and treat any unexplained privilege escalation on a current, fully updated Windows machine as worth investigating rather than dismissing.
Several of this researcher's earlier flaws were picked up and used in real attacks after publication. On the record so far, the gap between a release like this one and its appearance in the wild is measured in weeks.