ShieldBreak PoC Bypasses Microsoft Patch for CVE-2026-50656 via Cloud Filter API and CLFS Swap

The exploit plants an EICAR file, uses Object Manager symlinks to redirect Defender scans, then leverages CLFS to swap file identity mid-hydration so that wermgr.exe loads attacker-controlled code. This runs QueueReporting as SYSTEM. Unlike the original RoguePlanet race on virtual disks, ShieldBreak requires active Defender and targets cloud-hydration paths. Kevin Beaumont and Will Dormann independently confirmed execution on latest 25H2 builds, noting the techniques share no common primitives with the June patch.

Microsoft's July defense-in-depth update for CVE-2026-50656 introduced an 8-byte leak on Windows 11 25H2 and Server 2025, which the researcher weaponized into full bypass. Official statements claim coordinated disclosure and ongoing investigation, yet no revised patch has shipped despite PoC publication. Procurement records show Microsoft continues expanding Defender cloud features without public telemetry on scan-path integrity checks.

The pattern indicates Defender's reliance on user-mode callbacks and CLFS remains an unaddressed attack surface. Windows 10 editions are also vulnerable though unsupported in the PoC. Next expected milestone is either a silent engine update or public exploit integration into red-team frameworks within 60 days.