Microsoft Defender Flaw Lets Attackers Read Arbitrary Files

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in Microsoft Defender that allow attackers to bypass existing patches and escalate privileges on Windows systems.

CVE-2026-69414 (CVSS 9.8 — Critical): This vulnerability, ShieldBreak, allowed attackers to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems.[emaillocker id="1283"]

CVE-2026-50656: RoguePlanet is a zero-day that also allows attackers to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. CVE-2026-NNNNN (CVSS X.X — Severity): ShieldCrash is a bypass of the earlier ShieldBreak patch that allows arbitrary file reads as SYSTEM but not arbitrary writes or a full SYSTEM shell.

RECOMMENDATION:

We recommend you to update Windows to given versions: For CVE-2026-69414: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-69414 For CVE-2026-50656: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-50656

REFERENCES:

The following reports contain further technical details:

• https://www.theregister.com/security/2026/09/09/serial-microsoft-0-day-hunter-drops-yet-another-defender-exploit/5295335