EUVD-2026-58811
GHSA-7whx-j8gf-3fxv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low privileges suffices (AV:L, PR:L); no complexity barriers or user interaction; full triad impact on vulnerable system with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ". We are working to provide a high quality security update that addresses this vulnerability. We will provide information in this CVE when the update is available.
AnalysisAI
Elevation of privilege in the Microsoft Malware Protection Engine (Microsoft Defender), publicly named 'ShieldBreak', allows a locally authenticated low-privileged user to gain high-level system access. The CVSS vector confirms a local, low-complexity attack requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an existing low-privileged local user session on the target Windows system running an unpatched version of Microsoft Defender with the vulnerable Malware Protection Engine. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.8 (High) is consistent with a local privilege escalation with full system impact - the attack vector is Local (AV:L), complexity is Low (AC:L), and only low privileges are required (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A locally authenticated standard user on a Windows system running an unpatched Microsoft Defender engine executes proof-of-concept exploit code referencing the 'ShieldBreak' technique, exploiting a privilege flaw in the Malware Protection Engine process to gain elevated (likely SYSTEM-level) privileges. From there, the attacker can disable security controls, exfiltrate data, or establish persistent access. … |
| Remediation | Microsoft has released an official patch (RL:O in the CVSS temporal vector), available through the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69414. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Microsoft Defender, document current Malware Protection Engine versions, and review Microsoft's security advisory for CVE-2026-69414 to identify affected versions in your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Local privilege escalation in Microsoft Defender (Malware Protection Engine) enables an authenticated low-privileged att
Elevation of privilege in the Microsoft Malware Protection Engine (mpengine) - the scanning core shared by Microsoft Def
Remote code execution in Microsoft Defender (Microsoft Malware Protection Engine) enables unauthenticated network-based
Local code execution in Microsoft Defender (Microsoft Malware Protection Engine) allows an unauthorized attacker to run
Local code execution in Microsoft Defender's Malware Protection Engine (mpengine) arises from an integer underflow (CWE-
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today