Microsoft threatened legal action, and this researcher just dropped a new Windows bug anyway

Digital Trends may earn a commission when you buy through links on our site. Why trust us?

Microsoft’s legal threats clearly didn’t scare off security researcher Nightmare Eclipse. Just weeks after the company warned it might pursue researchers who release undisclosed bugs outside its official channels, Nightmare Eclipse published a fresh Windows vulnerability, and it’s a nasty one.

What exactly does ShieldBreak do?

The new bug, called ShieldBreak, targets Windows Defender, the built-in anti-malware engine that ships with every copy of Windows. When exploited successfully, it lets an attacker jump from a low-level user account to full system access, essentially handing over the keys to your entire device.

Nightmare Eclipse released the proof of concept as a downloadable Windows app, meaning someone would need to actually run it for the exploit to work. According to the researcher, ShieldBreak affects Windows 10, Windows 11, and Windows Server 2025. Security researcher Will Dormann confirmed the bug works, though he noted Windows Defender needs to be turned on for it to succeed.

This isn’t Nightmare Eclipse’s first rodeo either. ShieldBreak reportedly builds on an earlier exploit called RoguePlanet. Microsoft did patch that one, but the researcher claims the fix wasn’t good enough, and that ShieldBreak fully bypasses it.

Why is Microsoft caught in the middle again?

As TechCrunch first reported, this whole saga is part of a much longer feud between Nightmare Eclipse and Microsoft over how the company handles bug reports. The researcher has accused Microsoft of mishandling previous disclosures, which is why several bugs ended up published publicly instead of being quietly patched.

Back in May, Microsoft made things worse by threatening legal action against researchers who go public with zero-days outside its disclosure rules. The security community pushed back hard, and Microsoft eventually softened its stance on social media, though the original blog post is still live.

For now, Microsoft says it’s “aware of the reported vulnerability and is actively investigating.” No patch exists yet, so if you’re running Windows, this is one to keep an eye on.