---
id: 7548
title: "ShieldCrash: Windows Defender 0-Day PoC Bypassing ShieldBreak (CVE-2026-69414) Patch"
cve: CVE-2026-69414
cvss: 7.8
severity: high
vendor: "Microsoft"
product: "Windows Defender"
affected_versions: "All supported Windows versions (as of September 2026)"
source_domain: github.com
source_url: "https://github.com/MSNightmare/ShieldCrash"
published_at: "2026-09-07T20:36:17Z"
tags: ["cloud", "zero-day", "arbitrary-file-read", "microsoft", "red-team", "poc", "defense", "0day", "windows-defender", "cve-2026-69414"]
phying_url: "https://phying.com/item/7548"
lang: en
---

# ShieldCrash: Windows Defender 0-Day PoC Bypassing ShieldBreak (CVE-2026-69414) Patch

## Summary

ShieldCrash: a PoC showing Microsoft's ShieldBreak fix (CVE-2026-69414) to be incomplete, achieving arbitrary file read as SYSTEM in Windows Defender on all supported Windows versions.

## Why it matters

Highlights an incomplete patch in Microsoft Defender's scanning engine, allowing local unprivileged users to weaponize antivirus file inspection routines for SYSTEM-level file access.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-69414
- **CVSS:** 7.8
- **Vendor:** Microsoft
- **Product:** Windows Defender
- **Affected versions:** All supported Windows versions (as of September 2026)
- **Published:** 2026-09-07T20:36:17Z
- **Original:** https://github.com/MSNightmare/ShieldCrash
- **Phying News:** https://phying.com/item/7548