Executive Summary: A public proof-of-concept called ShieldBreak fully bypasses Microsoft's patch for the Windows Defender privilege-escalation flaw known as RoguePlanet (CVE-2026-50656, CVSS 7.8), letting an attacker who already has local code execution reach a SYSTEM-level shell on Windows 11 25H2 and Windows Server 2025 with a reported 100% success rate. No Microsoft fix currently closes this bypass. Deploy the interim mitigation in the Guardian dashboard and hunt for the associated exploitation indicators until one ships.
In mid-June 2026, Microsoft acknowledged RoguePlanet, a privilege-escalation flaw in the Microsoft Malware Protection Engine (mpengine.dll), the scanning engine behind Windows Defender. Microsoft rated it "Exploitation More Likely" on its Exploitability Index and assigned a CVSS score of 7.8. Microsoft shipped a fix in Malware Protection Engine version 1.1.26060.3008 during its July 2026 patch cycle.
On August 11, 2026, a security researcher publicly released a new proof-of-concept, ShieldBreak, claiming a full bypass of Microsoft's July fix. The PoC was tested with a reported 100% success rate against Windows 11 25H2, including Canary channel builds, and Windows Server 2025; multiple outlets report Windows 10 and its Server equivalents remain vulnerable to the same underlying flaw, though the public PoC does not officially target them. Independent testing confirmed the exploit works and found that Windows Defender must be enabled for it to succeed. As of this writing, Microsoft has not issued an update that closes the bypass, and its Security Update Guide for CVE-2026-50656 still lists the July engine update as the available remediation.
What the vulnerability is
RoguePlanet is a race condition (a check-then-act timing window) in mpengine.dll that a local attacker can win during a file scan to redirect it into a command shell running as NT AUTHORITY\SYSTEM. Microsoft's July fix closed one path into the vulnerable code. ShieldBreak reopens the underlying race through a different technique: it registers a rogue cloud storage provider, attaches it to a crafted placeholder file, and combines CLFS log manipulation with Object Manager symbolic links to trick Defender's scanning pipeline into locking a legitimate system file (reported as phoneinfo.dll) while a malicious substitute is swapped in underneath it, ultimately spawning a SYSTEM-level shell. Mapped to MITRE ATT&CK, the relevant techniques are T1068 (Exploitation for Privilege Escalation) and T1574 (Hijack Execution Flow).
Key facts to keep in mind
- Requires local code execution first: an attacker needs an existing foothold (a standard user session, a malicious file the user runs, or a prior-stage payload) to escalate. This is not a remote, unauthenticated attack.
- Windows Defender must be enabled and actively scanning for the exploit to work; endpoints where Defender is off, or where a different product is the registered antivirus, are not affected.
- Confirmed with a 100% success rate on Windows 11 25H2 (including Canary channel) and Windows Server 2025; Windows 10 and its Server equivalents are reported to share the underlying flaw but are not officially targeted by the current public PoC.
- No Microsoft security update currently closes the ShieldBreak bypass. The July 2026 Malware Protection Engine update (1.1.26060.3008) only addressed the original RoguePlanet path.
How Tanium can help
Tanium Guardian: The ShieldBreak: Windows Defender Zero-Day Exploit dashboard charts which endpoints have Windows Defender registered as the active antivirus provider, the population actually exposed, since the exploit doesn't run where Defender is off or a different product is registered, and includes an action to deploy the interim mitigation: a 0-byte phoneinfo.dll placeholder that blocks the file-substitution step the exploit depends on, plus a rollback package. Test the mitigation on a small group before deploying broadly; it can cause unwanted effects.
Tanium Threat Response: Run the Signals in the dashboard's Hunting Guidance section: one flags child processes of the Windows Error Reporting process (wermgr.exe) launched with a -upload command line, and another flags non-SYSTEM processes writing Report.wer files to the WER ReportQueue path, tuned against known false positives (Visual Studio's PerfWatson2.exe and devenv.exe, HxD.exe, and SQL Server's ScenarioEngine.exe). Unmodified ShieldBreak activity should still trigger the existing Tanium Signal: Conhost Spawned Executable and native Windows Defender signatures, though attackers weaponizing the exploit may evade signature-based detection.
Tanium Interact: Run the dashboard's pre-built questions (Non-SYSTEM User File Activity for Report.wer files, wermgr.exe Descendant Process Tree, and SYSTEM user processes with Windows Error Reporting in Ancestry) to scope activity across the fleet ad hoc.
References
- Microsoft Security Update Guide, CVE-2026-50656
- CVE-2026-50656 Detail - NVD
- CVE-2026-50656 - CVE Record
- Kudelski Security, "RoguePlanet" Zero Day MS Defender Privilege Escalation
- Security Affairs, ShieldBreak: New Windows Zero-Day Bypasses Microsoft's RoguePlanet Patch
- Security Affairs, Microsoft confirms RoguePlanet zero-day, patch under development
- Security Affairs, Microsoft fixed Defender flaw RoguePlanet (CVE-2026-50656)
- Tanium Threat Response User Guide, Adding intel (Signals)
- Tanium Interact User Guide, Interact overview
Guardian Research Team
The Guardian Research Team is a specialized group of cybersecurity experts tasked with identifying, analyzing, and providing actionable intelligence on critical, emerging, and zero-day threats.