Microsoft's own antivirus has a hole in it right now — and even Microsoft can't patch it yet

CVE-2026-69414 lets a local attacker walk straight to SYSTEM through Windows Defender itself, there's still no fix nine days after the CVE was… Aliteq Priya Nair · Software & Systems Editor

CVE-2026-69414 ("ShieldBreak") is an elevation-of-privilege zero-day in the Microsoft Malware Protection Engine, rated CVSS 7.8.

It hijacks Windows Defender's Cloud Filter API file-hydration process using a user-mode callback to reach NT AUTHORITY\SYSTEM.

Affects Windows 11 25H2 and Windows Server 2025. A public PoC landed August 12, 2026; the CVE was assigned August 14 — still no patch as of August 23.

It's a full bypass of the patch Microsoft shipped in mid-July for RoguePlanet (CVE-2026-50656), the previous Defender privilege-escalation zero-day.

CISA's BOD 26-04 puts it on a 14-day federal remediation clock — a reasonable deadline for everyone else to adopt too.

Two Defender privilege-escalation zero-days from the same research thread inside five weeks isn't bad luck — it's a pattern. Microsoft patched the symptom Chaotic Eclipse showed them and not the…

Read the full story

Aliteq Microsoft's own antivirus has a hole in it right now — and even Microsoft can't patch it yet Read the full story on Aliteq