High severity · published Aug 14, 2026
CVE-2026-69414
Microsoft Defender Elevation of Privilege Vulnerability
7.8
CVSS
1.3%
EPSS
No
On KEV
Description
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MM
Microsoft Malware Protection Engine · Microsoft
1.1.0.0 before 1.1.26080.3 · source: vendor
MP
Malware Protection Engine · Microsoft
All versions, or not specified · source: NVD
In the news
VulnerabilityHigh
Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed
The security researcher known as Chaotic Eclipse has dropped a proof-of-concept (PoC) for yet another zero-day in Microsoft Defender.
The vulnerability, codenamed ShieldCrash, is assessed to be a patch bypass for CVE-2026-69414 (CVSS score: 7.8), also called ShieldBreak, which the researcher reported last month.
"Microsoft has failed to properly patch ShieldBreak CVE-2026-69414," Chaotic
Sep 9, 2026·The Hacker News
VulnerabilityCritical
CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days
Executive Summary ShieldBreak (CVE-2026-69414) is a zero-day elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender, allowing a low-privilege local attacker to escalate to SYSTEM. A public PoC was released on August 12, 2026, and Microsoft assigned the CVE on August 14, and no patch is available yet. Qualys VMDR provides detection […]
Aug 25, 2026·Qualys Blog
VulnerabilityCritical
CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days
Executive Summary ShieldBreak (CVE-2026-69414) is a zero-day elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender, allowing a low-privilege local attacker to escalate to SYSTEM. A public PoC was released on August 12, 2026, and Microsoft assigned the CVE on August 14, and no patch is available yet. Qualys VMDR provides detection […]
Aug 20, 2026·Qualys Blog
VulnerabilityHigh
Microsoft working on Defender patch for ShieldBreak zero-day
Microsoft is working on a security patch for the "ShieldBreak" zero-day vulnerability disclosed last week by security researcher "Nightmare Eclipse" and now tracked as CVE-2026-69414. [...]
Aug 17, 2026·BleepingComputer
Affected product
MM
Microsoft Malware Protection Engine
Microsoft
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-69414
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-69414
vendor-advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69414
More from Microsoft Malware Protection Engine
7.8
CVE-2026-41091
Microsoft Defender Elevation of Privilege Vulnerability
8.1
CVE-2026-45584
Microsoft Defender Remote Code Execution Vulnerability
7.8
CVE-2026-55012
Microsoft Defender Remote Code Execution Vulnerability
7.8
CVE-2026-55011
Microsoft Defender Remote Code Execution Vulnerability
7.1
CVE-2022-37971
Microsoft Windows Defender Elevation of Privilege Vulnerability