Nightmare Eclipse disclosed a new local privilege escalation vulnerability named ShieldBreak that can grant SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. The report was published on August 12, 2026. The exploit bypasses the earlier RoguePlanet patch (CVE‑2026‑50656) by targeting a Defender cloud‑hydration scan via the Cloud Filter API. Security researcher Kevin Beaumont confirmed that testing on Windows 11 25h2 and Windows Server 2025 showed a 100 % success rate. Beaumont also released detection queries to help defenders identify the flaw. Microsoft stated it is aware of the claim and is investigating the validity of the report. The company emphasized its support for coordinated vulnerability disclosure. The disclosure follows Microsoft’s August Patch Tuesday, which addressed 421 security issues but did not include ShieldBreak. Nightmare Eclipse has released nine previous Windows vulnerabilities, most of which have patches; earlier bugs include BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, and RoguePlanet. After threatening legal action against the researcher in May, Microsoft withdrew its plan to involve the Digital Crimes Unit. The unpatched flaw remains a risk until Microsoft releases a fix.