Nightmare Eclipse Drops Windows Defender Zero-Day

A threat actor calling itself Nightmare Eclipse published a new zero-day exploit on September 10, this time targeting Windows Defender. The researcher, who three days earlier dropped privilege-escalation exploits for CrowdStrike Falcon, Nvidia drivers, and Avast, calls this one ShieldCrash, per Dark Reading.

The detail that sets it apart: SecurityWeek reports the exploit achieves full SYSTEM privileges on Windows machines running the September 2026 patches. Fully patched systems are affected. No CVE has been assigned, and Microsoft had not published an advisory as of the reporting.

What ShieldCrash does

The attack class is local privilege escalation: a low-privileged user account gains SYSTEM, Windows’ highest-privileged local execution context. The vector is Windows Defender itself, with no third-party software required.

SYSTEM access on an endpoint is the precondition for post-exploitation work that does the most damage. Credential dumping from LSASS memory, disabling endpoint sensors, deploying ransomware, and establishing persistent access through signed system channels all require it.

The arc of the campaign

Nightmare Eclipse’s September 7 release targeted endpoint security vendors’ own agents. The logic was straightforward: security software runs with elevated privileges by design, concentrating attack surface. CrowdStrike Falcon, Avast, and Nvidia display drivers were the named targets, as we covered then.

ShieldCrash moves the attack one level closer to the operating system’s own protection layer. Windows Defender is present on every standard Windows endpoint and cannot be uninstalled. There is no configuration change an administrator can make to remove the attack surface, short of waiting for Microsoft to patch it.

The pattern has precedent. In August, analysis of Microsoft’s Defender BTR.SYS boot driver found it could be used to disable competing security software. ShieldCrash is a different technical path, but the same surface: protection software as the vector.

Where this leaves defenders

There is no patch and no workaround. Organizations that applied this month’s Patch Tuesday updates, which addressed 974 vulnerabilities including two zero-days, remain exposed to ShieldCrash.

The practical guidance is limited for now: monitor Microsoft’s Security Response Center for a Defender advisory, and watch the CISA KEV catalog for an addition that would trigger the 21-day federal patching clock. Until then, treat local access controls on Windows endpoints as higher priority than they typically get.

The exploit is public. The patch is not.