Ubitquity releases ShieldBreak Windows Defender patch

Ubitquity and Nettwerked have released an interim mitigation patch for the ShieldBreak zero-day vulnerability in Windows Defender. The workaround is available as open-source software.

The flaw is a local privilege escalation issue affecting Windows 11 version 25H2 and Windows Server 2025. Details released by the two groups indicate that an attacker with standard user access could exploit the weakness to gain full SYSTEM-level control of a machine.

The mitigation package includes a PowerShell script designed to restrict Access Control Lists in common temporary directories. Its aim is to block the creation of the malicious junction points required for the exploit chain.

ShieldBreak centres on a Time-of-Check to Time-of-Use weakness combined with directory junction abuse in the Windows Defender service, MsMpEng.exe. The exploit path would allow an attacker to induce the service to alter critical operating system binaries.

That leaves organisations in a difficult position, as no official binary fix has yet been released publicly. Networks running affected versions of Microsoft's operating systems therefore face a period in which defenders must rely on temporary controls rather than a vendor patch.

Mitigation details

Alongside the script, the repository contains a conceptual breakdown of the exploit mechanism and a C++ source code example showing one approach to resolving this type of operating system flaw. The material refers to secure user impersonation and use of the FILE_FLAG_OPEN_REPARSE_POINT flag as part of a more permanent fix.

Administrators are advised to test the mitigation before broad deployment because tighter restrictions on junction creation in temporary directories may affect some legacy application installations. A rollback script is expected after an official Microsoft patch is distributed.

Ubitquity is known for blockchain-based recordkeeping in property title and real estate markets, while Nettwerked focuses on resilient technology communities. Their joint release reflects a wider trend in which software suppliers and independent groups publish stop-gap defences when serious vulnerabilities emerge before a formal vendor remedy is available.

Nathan Wosnack, Founder & CEO of Ubitquity, set out the company's reasoning in a statement on the release. "At Ubitquity, our core mission revolves around building immutable, decentralized infrastructure. However, the reality of the modern digital landscape is that the foundation of Web3 and enterprise security relies entirely on the integrity of centralized Web2 endpoints," he said.

He added: "If the underlying operating system running a blockchain node, a financial gateway, or a title registry database is compromised at the system level, the cryptographic immutability of the ledger cannot protect you. We cannot afford to sit idle and leave our networks exposed in the crossfire between independent researchers and major tech conglomerates. Security is, and must always be, a proactive and collective community effort. We must protect the endpoints to protect the network."

Exposure window

The case highlights the risks created by the gap between disclosure of a severe vulnerability and release of a vendor-supported correction. During that window, businesses, public bodies and individual users often must choose between accepting operational disruption from mitigations or leaving systems exposed to active abuse.

In this instance, the workaround is intended to keep affected systems online while removing a key step in the attack path. That may appeal to administrators overseeing business-critical services that cannot easily be shut down while awaiting a permanent fix.

Wosnack said the timing of defensive action was central to the decision to publish the tools. "True security requires agility and an uncompromising dedication to protecting users," he said.

He continued: "When a zero-day drops, the window of vulnerability is the most dangerous period for any organization. By sharing these interim solutions openly via NETTWERKED and UBITQUITY, we are equipping DevOps teams, sysadmins, and regular users with the tools they need to defend themselves today, while official channels catch up tomorrow. Protect your infrastructure, verify everything, and keep building securely."