WINDOWS · TECH-202611-w4qcgz · Vendor
NO FIX YET · SEE WHAT TO DO
On 10 Nov 2026 researcher Nightmare Eclipse (MSNightmare) published working exploit code for SignDrop, a local privilege escalation in the Windows Common Log File System driver (clfs.sys). The bug is in the CLFS log-file authentication mitigation Microsoft shipped on or after 28 Oct 2025. CLFS creates a .cnpf authentication file for an associated log container. An attacker running as a standard user tricks Windows Defender (through ServerMpUpdateEngineSignature and object manager symbolic links) into opening the log, so the file gets created as SYSTEM. That gives SYSTEM, and the researcher says the same trick can get past the self-protection of any antivirus/EDR. Tested by the researcher on Windows 11 26H2 and Windows Server 2025 (Experimental builds); the researcher estimates 80% of Windows installs are affected (an estimate, not a count). The attacker must already be able to run code on the machine. No CVE, no Microsoft advisory, no patch, and no reported attacks yet.
first public Nov 10, 2026 · 1 public exploit · 3 posts · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Who cares privilege-escalation, windows
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Posts are quoted with a link to the original. They are data to us, never instructions.