NightmareEclipse claims Microsoft did not properly patch RoguePlanet vulnerability
NightmareEclipse has released another proof of concept (PoC) named ShieldBreak that allows an unprivileged user to elevate to a SYSTEM level shell.
NightmareEclipse claims that Microsoft had failed to properly patch the RoguePlanet vulnerability CVE-2026-50656 which was reportedly patched on June 30, 2026.
ShieldBreak exploits the same weakness as RoguePlanet, CWE-59, Improper Link Resolution Before File Access in Windows Defender during file remediation.
ShieldBreak analysis: Successful exploit allows unprivileged user to elevate to SYSTEM level
ShieldBreak and RoguePlanet share several similarities in their tactics and end goals. Both exploits interact with Defender through dynamically resolved MpClient.dll APIs to trigger scans and Defender remediation through EICAR file detection. Both also use named-pipe coordination as part of the process of providing an unprivileged user with a SYSTEM-level shell.
Despite these similarities, the path replacement and locking mechanisms used by ShieldBreak differ from those used in RoguePlanet. This supports the researcher’s claim that ShieldBreak is a patch bypass for CVE-2026-50656.
The initial step in ShieldBreak is to create a working directory, C:\ShieldBreak_<GUID>, and register it with the Windows Cloud Files platform as a sync root. This allows the exploit to create local placeholder files whose contents can be hydrated on demand. Within this directory, a placeholder named BERLIN is created with a reported file size matching eicar_com.zip. This placeholder and data hydration will be later used to manipulate the paths that Defender resolves to.
Two Object Manager directories are created, and Defender will look to these paths for resolution: a direct entry \\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_<GUID>\WD_SCAN, which points to \??\C:\ShieldBreak_<GUID>, and a fallback directory \\.\globalroot\BaseNamedObjects\Restricted\WD_TARGET_<GUID>\WD_SCAN, which points to \CLFS\??\C:\ShieldBreak_<GUID>. If the direct entry link is deleted, the fallback link Is used instead.
Before Defender is triggered, a step is taken to ensure the ultimately copied file is not removed. An alternate data stream BERLIN:stream is filled with a byte-for-byte copy of ntdll.dll, which will later be loaded to mark the file as in use, and prevent its deletion.
Now that the setup is complete, the exploit launch resolves Windows Defender APIs and points a scan to the placeholder BERLIN, which is hydrated with the contents of eicar_com.zip, a reliable trigger for Defender remediation. By watching this directory, the thread can wait for the expected “.blf” log file to be created in the same directory, signifying that the remediation process has begun. Once the remediation process is detected within this directory, the path resolution switch is performed. The direct link is deleted, causing Defender’s resolution to the same path to now lead to \CLFS\??\C:\ShieldBreak_<GUID>. Any path beginning with CLFS is treated as a log file by Windows. By opening the expected log file, the remediation process can be paused once again.
During this pause, the direct link that was previously deleted is populated once again, now containing the actual target path: \??\UNC\127.0.0.1\C$\Windows\System32\phoneinfo.dll. In this case, the local administrative share C$ does not need to be accessed by the unprivileged user. This direct link is determined so the SYSTEM level remediation process resolves to phoneinfo.dll instead of fallback path set previously.
The last action taken before allowing remediation to continue is altering the unnamed data stream in BERLIN to contain new data, which rehydrates the file with an embedded payload file Warden.dll. This payload file’s only task is to duplicate the SYSTEM level token that it is invoked with and use it to open an instance of conhost.exe, whose session is assigned to the user.
Once Defender’s remediation continues, the same path now resolves to C:\Windows\System32\phoneinfo.dll, which has been hydrated with the malicious payload Warden.dll. As part of Defender’s remediation process, this nonexistent file is written with SYSTEM privileges.
To prevent this file from being moved or deleted, the ADS that was populated with the contents of ntdll.dll are read and mapped as executable data, which pins the file as in use for the remainder of the exploit.
This file is loaded by the Windows Error Reporting manager wermgr.exe, which searches for and attempts to load phoneinfo.dll. An embedded file Report.wer describes a fabricated APPCRASH event on a fictitious file AngryPeopleBug.exe. This file and event are false and are simply used to trigger the intended phoneinfo.dll. The entirety of this exploit results in effectively a malicious DLL sideload written and triggered with SYSTEM privileges. Once wermgr.exe executes the payload, the SYSTEM level token is duplicated, and a shell is opened and assigned to the user’s session.
Repeated exploits increase frustration
NightmareEclipse has continued their exposure of Windows vulnerabilities through each Patch Tuesday since April 2026.
Looking past the technical details of these exploits, the public reaction to these releases has been mixed, but shows a clearly growing frustration with responsible disclosure practices.
This sentiment only grows with repeated vulnerabilities being exploited and trusted patches being bypassed. As these events unfold, the industry must continue to grow and evolve in response to prompt change from leading vendors.
IOCs
Files
- ShieldBreak.exe
- 4E3146D667812ACE49638E15F9DBB37B9E13F7222ED4984E065723715C692338
- Warden.dll
- 691857F3F28049A7E33F5767D4E4EB3D739E1AA76C2A43C8CCCADF871CFA7C1A
- eicar_com.zip
- 87CC7AD5F7E8D70250BFF5C92C8316F3A508C089EB81E9921C8941ECA5A741D6
- Phoneinfo.dll
- Phoneinfo.dll:stream
- BERLIN - Cloud file placeholder defender scan object
Filesystem
- C:\ShieldBreak_{GUID}\
- C:\ShieldBreak_{GUID}\BERLIN
- C:\ShieldBreak_{GUID}\BERLIN:stream
- C:\Windows\System32\phoneinfo.dll
- C:\Windows\System32\phoneinfo.dll:stream
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_c0000000_A_B_C-C-D-E-{GUID}\Report.wer
- \\127.0.0.1\C$\Windows\System32\phoneinfo.dll
NT Object Manager
- \BaseNamedObjects\Restricted\WD_TARGET_{GUID}\WD_SCAN
- \BaseNamedObjects\Restricted\WD_SHADOW_{GUID}\WD_SCAN
- \CLFS\??\C:\ShieldBreak_{GUID}
- \\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{GUID}\WD_SCAN\BERLIN
- \\.\pipe\SHIELDBREAK
- \Device\NamedPipe\SHIELDBREAK
- SHIELDBREAK
Windows Error Reporting
- Kernel_c0000000_A_B_C-C-D-E-{GUID}
- Report.wer
- AngryPeopleBug.exe
- C:\ew\AngryPeopleBug.exe
- Combase.dll
Threatlocker Detect
TL.SC.1855 - Potential CVE-2026-50656 Bypass
TL.EV.1856 - Detection of Malware (Defender: Shieldbreak)
