NewApp Digest
search bot

Windows Server 2025

ShieldBreak: The Windows Defender Zero-Day With No Patch — Detect It, Mitigate It, With Qualys
Winsage
August 20, 2026

ShieldBreak: The Windows Defender Zero-Day With No Patch — Detect It, Mitigate It, With Qualys

ShieldBreak, identified as CVE-2026-69414, is a zero-day vulnerability in the Microsoft Malware Protection Engine that allows low-privileged local attackers to escalate privileges to SYSTEM. The public proof of concept was released on August 12, 2026, and Microsoft recognized the CVE on August 14, 2026. No patch is currently available. ShieldBreak exploits an elevation-of-privilege vulnerability by manipulating file processing during the cloud-file hydration process in Microsoft Defender, allowing attackers to control processes with elevated privileges. The exploit is functional on Windows 11 25H2 and Windows Server 2025. Qualys VMDR can detect this vulnerability using a specific query, and organizations can use Qualys TruRisk™ Eliminate for mitigation until a patch is released.
Microsoft Scrambles To Patch ShieldBreak Zero-Day Flaw In Windows Defender
Winsage
August 18, 2026

Microsoft Scrambles To Patch ShieldBreak Zero-Day Flaw In Windows Defender

A new exploit named ShieldBreak, developed by Nightmare-Eclipse, targets Microsoft Defender by allowing privilege escalation and bypassing previous security fixes related to the RoguePlanet vulnerability. ShieldBreak operates on Windows 11 25H2, its Canary channel, and Windows Server 2025, achieving a "100% success rate." Windows 10 may also be vulnerable, but the exploit is specifically designed for Windows 11. There is currently no patch for ShieldBreak, and users are advised to disable Microsoft Defender, implement two-factor authentication, and exercise caution with suspicious online activities. Malwarebytes has recommended its Premium Security antivirus as a temporary solution.
CISA: Windows Task Host flaw now exploited by ransomware gangs
Winsage
August 18, 2026

CISA: Windows Task Host flaw now exploited by ransomware gangs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that ransomware gangs are exploiting a significant vulnerability in the Windows Task Host system, tracked as CVE-2025-60710. This high-severity flaw, affecting Windows 11 and Windows Server 2025, allows local attackers with basic user permissions to escalate their privileges to SYSTEM level. Microsoft patched this vulnerability in November 2025, but it poses a threat to unpatched devices. CISA added CVE-2025-60710 to its list of actively exploited vulnerabilities on April 13 and provided Federal Civilian Executive Branch agencies with a two-week window to secure their systems. CISA warns that such vulnerabilities are frequent attack vectors for malicious actors and urges organizations to apply mitigations or discontinue the use of affected products. Additionally, CISA noted that ransomware groups are also exploiting a Microsoft SharePoint remote code execution vulnerability (CVE-2026-45659), confirmed to be actively exploited in early July. Since November 2021, CISA has identified 383 actively exploited vulnerabilities across various Microsoft products, with 112 being used in ransomware attacks.
Windows Server 2022 reaches end of mainstream support in 60 days
Winsage
August 17, 2026

Windows Server 2022 reaches end of mainstream support in 60 days

Microsoft has announced that the mainstream end date for Windows Server 2022 is set for October 13, 2026, after which it will enter extended support until October 14, 2031. Windows Server 2022 became generally available in September 2021 and is part of the Long-Term Servicing Channel (LTSC) offering, which guarantees a decade of support. Microsoft recommends upgrading to Windows Server 2025, which will be generally available in November 2024, and will reach its end of support on November 13, 2029, with five years of extended support until November 14, 2034. A free 180-day trial of Windows Server 2025 is available. Additionally, hotpatching for Windows Server 2022 will be extended until October 2027 for Datacenter: Azure Edition systems. The free Windows 10 Extended Security Updates (ESU) program has been extended by an additional year, and Windows 11 23H2 Enterprise and Education editions will end updates on November 10, 2026, with a recommendation to upgrade to Windows 11 25H2.
Windows 11 24H2, Windows Server 2022, Windows 10 Ent. LTSB 2016 get 60-day cut off warnings
Winsage
August 15, 2026

Windows 11 24H2, Windows Server 2022, Windows 10 Ent. LTSB 2016 get 60-day cut off warnings

Microsoft has issued a 60-day notice regarding the end-of-life dates for several products, following a previous 90-day warning. Mainstream support for Windows Server 2022 will end on October 13, 2026, affecting all editions. Users of Windows 11 version 24H2 Home and Pro, as well as Windows 10 Enterprise LTSB 2016, will stop receiving updates. Microsoft recommends upgrading to Windows Server 2025, with an extended support phase lasting until October 14, 2031, for those unable to upgrade immediately. Windows 11 version 24H2 users must upgrade to version 25H2 to continue receiving updates, while Enterprise and Education variants will have a grace period until October 2027. Organizations using Windows 10 Enterprise LTSB 2016 should transition to Windows 11 Enterprise LTSC 2024, with Extended Security Updates available for purchase for those who remain on the older system. A 180-day evaluation build of Windows Server 2025 can be downloaded for compatibility testing.
Microsoft-vendetta hacker has a new zero day that gives system privileges on fully patched Windows
Winsage
August 13, 2026

Microsoft-vendetta hacker has a new zero day that gives system privileges on fully patched Windows

Nightmare Eclipse has released a new zero-day exploit called ShieldBreak, which can bypass Microsoft's RoguePlanet patch (CVE-2026-50656) and allow attackers to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. The exploit has been confirmed by security expert Kevin Beaumont, who provided detection methods for it. ShieldBreak is the tenth zero-day from Nightmare Eclipse since April and was released shortly after Microsoft's monthly Patch Tuesday. The exploit allows local privilege escalation and has a 100% success rate on the latest version of Windows 11 and Windows Server 2025, while Windows 10 remains vulnerable. Microsoft is aware of the vulnerability and is investigating it, emphasizing the importance of coordinated vulnerability disclosure. Previous exploits from Nightmare Eclipse include LegacyHive and GreatXML, with earlier vulnerabilities having been patched but recent ones still unaddressed. Microsoft had threatened legal action against Nightmare Eclipse in May but later reconsidered its approach to vulnerability disclosure.
Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’
Winsage
August 13, 2026

Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’

Security researcher Nightmare Eclipse has released a zero-day exploit named ShieldBreak that allows privilege escalation on Windows by targeting a vulnerability in Microsoft Defender. This exploit, designated as CVE-2026-50656, is categorized as a race condition vulnerability and affects the latest versions of Windows 11 and Windows Server 2025, with potential impacts on Windows 10. The exploit was disclosed on June 9, 2026, and Microsoft acknowledged the issue on June 16, rolling out fixes by July 9. The mechanics of ShieldBreak involve manipulating Defender’s scan path and executing a scheduled task to gain System-level privileges. Experts have noted differences between ShieldBreak and the previously known RoguePlanet exploit, emphasizing that ShieldBreak requires Defender to be active to function.
After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug
Winsage
August 12, 2026

After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug

A security researcher named Nightmare Eclipse has discovered a vulnerability in Windows, called ShieldBreak, which allows hackers to gain system-wide access to users' devices and sensitive data by exploiting a flaw in Windows Defender. The vulnerability affects Windows 10, Windows 11 (including version 25H2), and Windows Server 2025. A proof-of-concept exploit has been provided, requiring users to run a Windows application to trigger the vulnerability. Security researcher Will Dormann confirmed that Windows Defender must be enabled for the exploit to work. Microsoft has not yet released a patch for ShieldBreak, which is classified as a zero-day vulnerability. This discovery follows previous vulnerabilities disclosed by Nightmare Eclipse, including RoguePlanet, for which Microsoft issued an inadequate patch. The situation has heightened tensions between the researcher and Microsoft regarding the handling of bug reports, especially after Microsoft threatened legal action against researchers disclosing zero-days outside established protocols. The disclosure of ShieldBreak occurred shortly after Microsoft's monthly security patch releases, which have been increasing in number.
Search