Despite Microsoft’s Threat, New Windows Vulnerability Disclosed

An information security researcher has publicly disclosed details of a serious vulnerability in recent versions of the Windows operating system despite warnings that Microsoft could take legal action. The vulnerability is particularly significant because it could allow criminals to gain full system-level access to a user’s device and data. Techcrunch.com reports .

According to ixbt.com, this new vulnerability, called ShieldBreak, was disclosed by a researcher operating under the alias Nightmare Eclipse. In recent months, the researcher has shared information about several previously unknown flaws in Microsoft products, including Windows. ShieldBreak is based on exploiting a weakness in the Windows Defender security system.

How the Vulnerability Works

If the attack is successful, a hacker can elevate their low-level user privileges to full administrative control. The researcher presented the exploit as a Windows application, meaning the user must run the application on their device for the flaw to be exploited.

According to the researcher, the flaw remains effective on Windows 10, Windows 11, including the latest 25H2 version, and the Windows Server 2025 operating systems. Another security expert, Will Dormann, also confirmed that the flaw works in practice and that Windows Defender must be enabled for this to occur.

Negotiations and Future Risks

This new exploit is a continuation of a flaw previously developed under the name RoguePlanet. Although Microsoft released a special patch for RoguePlanet, the researcher stated that the company’s measure was insufficient and that the latest ShieldBreak demonstrates a complete bypass of the previous fix. Microsoft has not yet released an official fix for this vulnerability.

The flaw is being classified as a zero-day vulnerability because the software developer was not given sufficient advance time to address it. This case is the latest development in a long-running dispute between the researcher and the tech giant over its vulnerability disclosure policy.

In May, Microsoft published a statement threatening to take legal action against security researchers. Although the company later softened its wording in social media posts, the original blog post remained unchanged. Experts say such cases once again demonstrate the importance of transparency and communication in ensuring technology security.