In mid-August 2026, a zero-day vulnerability dubbed ShieldBreak was discovered in Windows Defender. According to available reports, exploiting this flaw allowed attackers to escalate privileges to the SYSTEM level on Windows 10, Windows 11, and Windows Server systems — effectively gaining full control over a compromised machine. The disclosure, per industry publications, was carried out by a figure known in the community as a "controversial vulnerability hunter" under the pseudonym Nightmare Eclipse. Microsoft quickly released a security update intended to close ShieldBreak, yet this very patch, according to numerous user reports, triggered a new, functional failure in the antivirus module.
What Is ShieldBreak and Who Was at Risk
The ShieldBreak vulnerability affects the core of Windows' security subsystem and allows an attacker who already has limited rights on the system to escalate them to the SYSTEM level. This is a critical scenario: SYSTEM privileges grant access to system files, the registry, services, and persistence mechanisms, making the compromise virtually irreversible for the end user. All current desktop and server editions of Windows — from Windows 10 through Windows 11 and Windows Server — fell within the risk zone. That is precisely why Microsoft issued the patch on an emergency basis, without waiting for the regular "Patch Tuesday."
Trying to Patch the Hole, Microsoft Broke Scanning
The paradox of the situation is that the update meant to strengthen protection effectively disabled the primary threat-detection tool. Users report that after installing the fix, Windows Defender can no longer complete either a quick or a full scan: both operations abort with an error at the final stage. It is separately noted that offline scanning hangs at the 91% mark and never proceeds to completion. Meanwhile, a manual scan of the entire drive still runs correctly, which suggests the problem lies not with the antivirus engine as a whole, but with how Defender handles certain types and sequences of scanning operations.
Failure Symptoms and Traces in the Event Log
The technical details of the failure are corroborated by entries in the Windows Event Log. The logs show errors with code 0x000005 pointing to the mpengine.dll library — a key component of Microsoft's antivirus engine responsible for file analysis. At the same time, DefenderApiLoggerLowPriv session errors are recorded, indicating failures in the defender's low-privilege API logger. Taken together, these signs point to the update having affected the internal logic for scheduling and completing scans, rather than a single process simply "hanging."
Which Versions Are Affected
According to Aryeh Goretsky, head of the Neowin forum and a former ESET researcher, scanning failures are observed in Windows Defender versions v1.1.26070.7 and v1.1.26080.2 when used in combination with certain releases of the Microsoft Security Intelligence Update. The exact list of specific security update numbers is not fully provided in public summaries, so users are advised to cross-check their installed versions against the vendor's current recommendations. The only working workaround at present remains rolling the system back to previous versions of Defender, which in effect restores functional scanning.
Contradictory Data
There is a notable discrepancy in positions here. On the one hand, Microsoft has not officially acknowledged that the latest Defender update was the cause of the scanning failures — the vendor has issued no public confirmation of this causal link. On the other hand, circumstantial evidence points the other way: rolling back to earlier versions of the module consistently resolves the issue, which logically confirms the blame on the recent updates. Moreover, in some primary sources the disclosure of the ShieldBreak vulnerability is attributed to a specific Nightmare Eclipse account, while other summaries use the more general phrasing "controversial vulnerability hunter," without a definitive tie to a single pseudonym. Finally, the full list of affected Microsoft Security Intelligence Update versions is presented only in fragments in public materials, creating uncertainty for some users.
What Users Should Do
Until Microsoft releases a corrective patch, users experiencing non-functional scanning are advised to temporarily roll Windows Defender back to a previous stable version via component-recovery mechanisms or by uninstalling the latest security update. An alternative working option is to use a manual full-drive scan, which, according to reports, continues to function. It is important to note, however, that until the failure is fully resolved the system remains at risk: the automatic and offline checks, which serve as the primary barrier against new threats, are effectively disabled. Experts recommend refraining from installing potentially dangerous files and, where possible, temporarily deploying a third-party antivirus module until an official fix is released.
