Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2026-62832 | 7.8 | 3.3% | — | — | 45.7 (Medium) |
ShieldBreak: The 10th Windows LPE from Nightmare-Eclipse
ShieldBreak is the tenth proof-of-concept in the Nightmare-Eclipse series, following BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, GreatXML, RoguePlanet, and LegacyHive. The actor released it shortly after Microsoft’s August 2026 Patch Tuesday, which patches CVE-2026-62832 in the Windows User Profile Service.
The vulnerability is an improper link resolution before file access in the User Profile Service, allowing an authorized attacker to elevate privileges locally. It carries a CVSS 7.8 score and an EPSS of 3.3% (88th percentile). No KEV listing or public PoC was known at release time.
The exploit drops a DLL into System32 and loads it via wermgr.exe, which runs as SYSTEM. A SYSTEM-integrity process then connects to a user-created named pipe, completing the local privilege escalation without an interactive admin prompt.
The Four-Stage Exploit Chain
The exploit chain executes in four stages. Stage 1 performs an Object Manager namespace hijack by calling NtCreateSymbolicLinkObject followed by NtCreateDirectoryObjectEx from user mode, allowing the attacker to intercept object paths before the target resolves them.
Stage 2 hijacks the Cloud Files API by calling CfRegisterSyncRoot from a non-cloud-sync process, registering the attacker’s sync root to intercept file operations. This is the same technique shared with LegacyHive.
Stage 3 triggers Windows Defender remediation via a direct API call, forcing Defender to process the file and execute the remediation path that loads the planted DLL.
Stage 4 is a timing race: the attacker drops phoneinfo.dll into System32 and triggers wermgr.exe to load it before the race window closes. wermgr.exe runs as SYSTEM, so the DLL executes at SYSTEM integrity. A SYSTEM-integrity process then connects to the user-created named pipe, completing the local privilege escalation without an interactive admin prompt.
How the DLL Gets Loaded as SYSTEM
The final stage of the chain relies on Windows Error Reporting to load the planted DLL at SYSTEM integrity. wermgr.exe, a trusted system binary, loads phoneinfo.dll from the System32 directory, a pattern that generates a Sysmon EID 7 event with near-zero false positives. The DLL executes at SYSTEM integrity because wermgr.exe runs as SYSTEM, giving the attacker a high-integrity context to complete the privilege escalation.
Once the DLL is loaded, a SYSTEM-integrity process connects to the user-created SHIELDBREAK named pipe, which was created in an earlier stage. This connection is captured by Sysmon EID 18 and completes the local privilege escalation without an interactive admin prompt. The entire flow moves a standard user to SYSTEM in a single pass, which is the same pattern used across all ten Nightmare-Eclipse LPE tools.
The QueueReporting scheduled task is triggered via ITaskService::Run(), generating Security EID 4698 and 4702 events. This is the standard mechanism Nightmare-Eclipse uses to kick off the exploit from user context, and it avoids the UAC prompt that would otherwise appear for an interactive admin.
Detection and Hunting
LevelBlue published a YARA rule, ShieldBreak_WD_Pipeline_LPE_PoC, marked TLP WHITE, that matches the binary by its NT Object Manager strings. The rule anchors on NtCreateSymbolicLinkObject and NtCreateDirectoryObjectEx as ASCII or wide strings, the same fingerprint shared with LegacyHive.
For runtime detection, Sysmon EID 17 catches the hardcoded named pipe name. The PoC creates a pipe with a fixed name, so you can filter on the pipe name string in the CreateProcess event. EID 7 is the high-signal event: it fires when wermgr.exe loads phoneinfo.dll from System32, and it has near-zero false positives because the DLL name and path are specific to this PoC. EID 18 captures the SYSTEM process connecting to the user-created named pipe, which is the final step that completes the privilege escalation.
Key points
- ShieldBreak is the tenth release in the Nightmare-Eclipse series, following BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, GreatXML, RoguePlanet, and LegacyHive.
- The PoC abuses Cloud Files, Object Manager namespace, Defender API, and a remediation timing race to drop a DLL into System32 and run as SYSTEM.
- wermgr.exe loads phoneinfo.dll from System32, and a SYSTEM-integrity process connects to the SHIELDBREAK named pipe.
- CVE-2026-62832 is a Windows User Profile Service LPE with CVSS 7.8, EPSS 3.3% (88th pct), and PRS risk 45.7 (Medium).
- No CVE was assigned and no patch was available at time of writing; updated Defender signatures appear sufficient to block the exploit in its current public state.