{
  "snapshotDate": "2026-09-05",
  "scope": "Local review draft of the 5 September 2026 type-level analysis, curated to C2 and M3/M4/N3. No external facts were refreshed, no exploit or perturbation was executed, no detector was tested, and no deployed posture was supplied. All modeled requirements are inferred.",
  "sources": [
    {
      "id": "S01",
      "title": "Sheel, Vamika. \"CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days.\" Qualys Blog, 25 August 2026, updated 3 September 2026.",
      "url": "https://blog.qualys.com/product-tech/2026/08/24/shieldbreak-the-windows-defender-zero-day-with-no-patch-detect-it-mitigate-it-with-qualys",
      "kind": "secondary-report",
      "retrieval": "full text retrieved 2026-09-05",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": true,
      "archiveReferenceId": 1,
      "evidenceRefs": [
        "archive-yaml#references/1"
      ]
    },
    {
      "id": "S02",
      "title": "\"ShieldBreak: A Local Privilege Escalation Path Through Microsoft Defender.\" CyberMaxx, August 2026.",
      "url": "https://www.cybermaxx.com/resources/shieldbreak-a-local-privilege-escalation-path-through-microsoft-defender/",
      "kind": "secondary-report",
      "retrieval": "search excerpt only",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": true,
      "archiveReferenceId": 2,
      "evidenceRefs": [
        "archive-yaml#references/2"
      ]
    },
    {
      "id": "S03",
      "title": "\"Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak).\" Arctic Wolf, August 2026.",
      "url": "https://arcticwolf.com/resources/blog/cve-2026-50656-rogueplanet-shieldbreak/",
      "kind": "secondary-report",
      "retrieval": "search excerpt only",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": true,
      "archiveReferenceId": 3,
      "evidenceRefs": [
        "archive-yaml#references/3"
      ]
    },
    {
      "id": "S04",
      "title": "\"ShieldBreak bypasses Microsoft's patch for earlier Defender flaw.\" Malwarebytes Labs, August 2026.",
      "url": "https://www.malwarebytes.com/blog/bugs/2026/08/shieldbreak-bypasses-microsofts-patch-for-earlier-defender-flaw",
      "kind": "secondary-report",
      "retrieval": "search excerpt only",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": true,
      "archiveReferenceId": 4,
      "evidenceRefs": [
        "archive-yaml#references/4"
      ]
    },
    {
      "id": "S05",
      "title": "\"New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges.\" BleepingComputer, August 2026.",
      "url": "https://www.bleepingcomputer.com/news/security/new-microsoft-defender-shieldbreak-zero-day-grants-system-privileges/",
      "kind": "secondary-report",
      "retrieval": "search excerpt only",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": true,
      "archiveReferenceId": 5,
      "evidenceRefs": [
        "archive-yaml#references/5"
      ]
    },
    {
      "id": "S06",
      "title": "\"Microsoft working on Defender patch for ShieldBreak zero-day.\" BleepingComputer, August 2026. Carries Will Dormann's confirmation that the exploit works and that Defender must be enabled.",
      "url": "https://www.bleepingcomputer.com/news/security/microsoft-working-on-defender-patch-for-shieldbreak-zero-day/",
      "kind": "secondary-report",
      "retrieval": "search excerpt only",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": true,
      "archiveReferenceId": 6,
      "evidenceRefs": [
        "archive-yaml#references/6"
      ]
    },
    {
      "id": "S07",
      "title": "\"ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access.\" The Hacker News, 13 August 2026 (updated after publication).",
      "url": "https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html",
      "kind": "secondary-report",
      "retrieval": "search excerpt only",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": true,
      "archiveReferenceId": 7,
      "evidenceRefs": [
        "archive-yaml#references/7"
      ]
    },
    {
      "id": "S08",
      "title": "MSNightmare. \"ShieldBreak: Windows Defender 0day vulnerability.\" GitHub repository, August 2026. Repository description only; no exploit content was read, retrieved or reproduced.",
      "url": "https://github.com/MSNightmare/ShieldBreak",
      "kind": "repository-description",
      "retrieval": "repository description only",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": false,
      "archiveReferenceId": 8,
      "evidenceRefs": [
        "archive-yaml#references/8"
      ],
      "originalTitle": "MSNightmare. \"ShieldBreak \" Windows Defender 0day vulnerability.\" GitHub repository, August 2026. Repository description only; no exploit content was read, retrieved or reproduced.",
      "displayTitleNote": "Punctuation normalized for display from the archived title; original wording has not been independently checked.",
      "titleCorrection": {
        "basis": "Editorial display correction from the archived words",
        "externalVerification": "not-performed"
      }
    },
    {
      "id": "S09",
      "title": "\"CVE-2026-69414 Defender Flaw Has No Fix or Affected Builds.\" Windows Forum, 3 September 2026.",
      "url": "https://windowsforum.com/windows-news.4/cve-2026-69414-defender-flaw-has-no-fix-or-affected-builds.443144/",
      "kind": "secondary-report",
      "retrieval": "search excerpt only",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": true,
      "archiveReferenceId": 9,
      "evidenceRefs": [
        "archive-yaml#references/9"
      ]
    },
    {
      "id": "S10",
      "title": "\"CVE-2026-50656: Microsoft Defender RoguePlanet Zero-Day Enables Local Privilege Escalation on Fully Patched Windows 10 and 11 Systems.\" Rescana, 18 June 2026.",
      "url": "https://www.rescana.com/post/cve-2026-50656-microsoft-defender-rogueplanet-zero-day-enables-local-privilege-escalation-on-fully-patched-windows-10-11",
      "kind": "secondary-report",
      "retrieval": "search excerpt only",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": false,
      "archiveReferenceId": 10,
      "evidenceRefs": [
        "archive-yaml#references/10"
      ],
      "originalTitle": "\"CVE-2026-50656: Microsoft Defender RoguePlanet Zero-Day Enables Local Privilege Escalation on Fully Patched Windows 10 \" 11 Systems.\" Rescana, 18 June 2026.",
      "displayTitleNote": "Punctuation normalized for display from the archived title; original wording has not been independently checked.",
      "titleCorrection": {
        "basis": "Editorial display correction from the archived words",
        "externalVerification": "not-performed"
      }
    },
    {
      "id": "S11",
      "title": "\"Microsoft fixed Defender flaw RoguePlanet (CVE-2026-50656).\" Security Affairs, 9 July 2026. Source for the Windows Server mounting limitation.",
      "url": "https://securityaffairs.com/195016/security/microsoft-fixed-defender-flaw-rogueplanet-cve-2026-50656.html",
      "kind": "secondary-report",
      "retrieval": "search excerpt only",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": true,
      "archiveReferenceId": 11,
      "evidenceRefs": [
        "archive-yaml#references/11"
      ]
    },
    {
      "id": "S12",
      "title": "\"CVE-2026-50656 'RoguePlanet': Microsoft Defender Malware Protection Engine Privilege Escalation to SYSTEM.\" Threat-Modeling.com, 9 July 2026. Source for engine version 1.1.26060.3008.",
      "url": "https://threat-modeling.com/cve-2026-50656-rogueplanet-microsoft-defender-privilege-escalation/",
      "kind": "secondary-report",
      "retrieval": "search excerpt only",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": true,
      "archiveReferenceId": 12,
      "evidenceRefs": [
        "archive-yaml#references/12"
      ]
    },
    {
      "id": "S13",
      "title": "\"RoguePlanet LPE Exploit CVE-2026-50656 Analysis.\" femtosec, 14 July 2026. Source for the reported five-second chain and the dark-web exploit sales.",
      "url": "https://femtosec.io/threat-intelligence/rogueplanet-cve-2026-50656-privilege-escalation",
      "kind": "secondary-report",
      "retrieval": "search excerpt only",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": true,
      "archiveReferenceId": 13,
      "evidenceRefs": [
        "archive-yaml#references/13"
      ]
    },
    {
      "id": "S14",
      "title": "\"CVE-2026-50656 RoguePlanet, Defender's Race to SYSTEM.\" Penligent, 19 June 2026. Source for the detection guidance on privileged security processes.",
      "url": "https://www.penligent.ai/hackinglabs/cve-2026-50656/",
      "kind": "secondary-report",
      "retrieval": "search excerpt only",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": true,
      "archiveReferenceId": 14,
      "evidenceRefs": [
        "archive-yaml#references/14"
      ]
    },
    {
      "id": "S15",
      "title": "Microsoft Security Response Center. Security Update Guide entry for CVE-2026-69414. Not retrieved directly; status as reported by references 1 and 9.",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69414",
      "kind": "primary-registry",
      "retrieval": "not retrieved",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": true,
      "archiveReferenceId": 15,
      "evidenceRefs": [
        "archive-yaml#references/15"
      ]
    },
    {
      "id": "S16",
      "title": "CVE Program record, CVE-2026-69414.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-69414",
      "kind": "primary-registry",
      "retrieval": "not retrieved",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": true,
      "archiveReferenceId": 16,
      "evidenceRefs": [
        "archive-yaml#references/16"
      ]
    },
    {
      "id": "S17",
      "title": "\"ShieldBreak In-Depth Analysis.\" CRYPTRON Security GmbH, August 2026. Source for the phase sequence: detected test content served first, payload served on restart hydration, Object Manager links redirected concurrently. Direct retrieval refused by the site's robots policy; search excerpt only.",
      "url": "https://www.cryptron.ch/en/blog-detail/ShieldBreak-In-Depth-Analysis.html",
      "kind": "secondary-report",
      "retrieval": "search excerpt only, retrieval refused",
      "statusNote": "Retrieval label is copied from the 2026-09-05 archive, not a new retrieval. External content was not revisited for this local draft.",
      "archivalTitle": true,
      "archiveReferenceId": 17,
      "evidenceRefs": [
        "archive-yaml#references/17"
      ]
    }
  ]
}