In August 2026, three separate attack techniques were published, each capable of bypassing protections built into fully patched Windows systems. The targets: the capacity a memory module reports about itself, how Microsoft Defender handles files, and Plug and Play (PnP), the mechanism Windows uses to automatically install signed drivers. All three work by manipulating, from the side, information or processes that a higher-level defense implicitly trusts—reaching SYSTEM privileges or virtualization-based protected regions in the process. However, these are not three variants of the same vulnerability class. They differ in the initial privileges required and in the countermeasures administrators need to take.
When RAM Lies About Its "Capacity," the VBS Wall Disappears
The attack that strikes the deepest layer of protection is "Download More RAM," presented at USENIX Security '26 by a research team from the University of Birmingham and Durham University. The researchers executed a memory-aliasing attack from software on Windows 11—an attack that previously required physically removing and reinserting memory modules. The paper received a Distinguished Paper Award.
The target is DDR4 or DDR5 DIMMs whose configuration data, known as Serial Presence Detect (SPD), can be rewritten. When an attacker with local administrator privileges alters the SPD's row address information, the DIMM reports that it has twice its actual capacity installed. This causes high addresses that shouldn't exist to overlap with the lower region of real memory, allowing the same physical region to be read from a different address. The mechanism bypasses access controls that the OS and processor placed on the legitimate address—circumvented via an aliased address.
From this pathway, the research team rewrote the secure kernel's code integrity checks and reloaded a vulnerable driver that had already been blocked. As a result, they demonstrated crossing the boundary of Virtualization-Based Security (VBS) and Hypervisor-Enforced Code Integrity (HVCI), stopping Defender and third-party EDR products, and even tampering with enterprise device management settings and kernel-level anti-cheat systems. A reboot occurs midway through the attack, but the researchers packaged the entire sequence into a one-click script.
Successful exploitation requires already having local administrator privileges and a DIMM with SPD write protection disabled. This is therefore not a remote code execution technique for achieving initial compromise, but a means of breaking the final boundary that VBS protects after administrator privileges have already been obtained. Among the three vendors investigated—Corsair, G.Skill, and ADATA—each had at least one product line with write protection disabled. The research team estimates these three vendors account for more than 55% of the high-performance consumer RAM market and over 70% of the gaming segment.
Microsoft assigned CVE-2026-23670 and mitigated the current attack in its April 2026 update. While enabling Secure Boot prevents the attack, devices with it disabled remain at risk. Corsair's iCUE and HWiNFO have gained features to enable DIMM write protection, and some motherboards can also disable writes via BIOS settings.
ShieldBreak: Circumventing an Already-Patched Defender
A proof-of-concept called "ShieldBreak" has been published claiming to bypass, via a different path, an issue Microsoft had supposedly already fixed—this time targeting Microsoft Defender. Microsoft classified the local privilege escalation vulnerability RoguePlanet as CVE-2026-50656 and addressed it in Defender Engine 1.1.26060.3008, dated June 30, 2026. However, ShieldBreak's author, Nightmare Eclipse, claims to have completely circumvented that fix, achieving SYSTEM privileges from a standard user account.
According to the public repository, the PoC was tested on Windows 11 25H2 Canary Channel and Windows Server 2025, achieving a 100% success rate in the author's environment. The author claims Windows 10 and its corresponding Server version are also vulnerable, though the PoC does not support them. This success rate and scope are the author's own reporting—not figures confirmed by Microsoft.
Even so, there are independent reports that the PoC works. The Register reported that security researcher Kevin Beaumont reproduced it on a current build of Windows 11. According to Beaumont's analysis, while RoguePlanet exploited a filesystem race condition, ShieldBreak works through Cloud Filter API (CFAPI) callbacks, swapping file contents mid-process while Defender fetches and scans a cloud-hosted file. Microsoft told the publication it was investigating the validity and applicability of the claims. At this stage, the fact that CVE-2026-50656 is marked as fixed cannot be taken to mean ShieldBreak has also been resolved.
PnP's Automatic Installation: Bridging USB and RDP
"Plug and Pwn," presented at DEF CON 34, is not a single Windows zero-day and has no corresponding CVE. Researchers Alejandro Hernando and Borja Martínez targeted an existing PnP pathway: Windows fetches signed packages matching a connected device's ID from Windows Update and runs the vendor's installation code with SYSTEM privileges. A valid signature does not equate to the services or co-installers within a package being securely implemented.
In a physical-attack demonstration, starting from a fully updated Windows 11 system with no one logged on, the researchers reached SYSTEM in about five minutes by impersonating a USB device. They chained together an access control flaw in Sierra Wireless software (rewriting DNS) with an HTTP communication and path traversal issue in a co-installer for Sony's FeliCa technology. Vendor-side behaviors that might individually be classified as low severity became a single unified attack when chained through PnP's automatic installation pathway.
A separate demonstration named "NoPlug & Pwn" doesn't even require a physical USB device. A standard user authenticates to RDP and sends a fake device descriptor over the USB redirection channel; the server then enumerates devices as though real hardware were present. By having the server install a signed package for Intel RealSense and loading a DLL from a writable folder, the researchers escalated to SYSTEM privileges.
This remote pathway has clear constraints. RDP's USB redirection is disabled by default; it's relevant only in cases like VDI environments where the server side has intentionally enabled it. The attacker also needs a valid RDP session. This is not an unauthenticated attack over the open internet.
Updates Alone Don't Provide Complete Protection
There's no single fix button common to all three attacks. For Download More RAM, in addition to Windows Update, administrators should enable Secure Boot and verify SPD write protection status on either the DIMM or the BIOS side. For ShieldBreak, they need to follow Microsoft's investigation results and any additional Defender engine updates. Against Plug and Pwn, disabling unnecessary RDP USB redirection and using device installation restrictions along with an allowed hardware ID list are recommended. The researchers also recommend enabling DisableCoInstallers, though they note this doesn't stop SYSTEM-level execution achieved without using co-installers.
What these three cases demonstrate is a problem that lies inside the conventional boundary of "unpatched systems are dangerous." When things assumed to be trustworthy—a RAM module's self-reported capacity, data being scanned by Defender, a signed driver—become the next attack input, the defense itself is attacked along with its underlying assumptions. Beyond simply checking update history, administrators need to verify the actual effective state of Secure Boot, the patch level of the Defender engine, and the scope of functionality permitted for PnP and RDP.