{"id":"TECH-202611-w4qcgz","kind":"technique","aliases":[],"related":[],"title":"SignDrop: unpatched Windows zero-day in the CLFS log driver lets any logged-in user become SYSTEM and can switch off antivirus/EDR (public exploit code, no fix, no CVE)","description":null,"summary":"On 10 Nov 2026 researcher Nightmare Eclipse (MSNightmare) published working exploit code for SignDrop, a local privilege escalation in the Windows Common Log File System driver (clfs.sys). The bug is in the CLFS log-file authentication mitigation Microsoft shipped on or after 28 Oct 2025. CLFS creates a .cnpf authentication file for an associated log container. An attacker running as a standard user tricks Windows Defender (through ServerMpUpdateEngineSignature and object manager symbolic links) into opening the log, so the file gets created as SYSTEM. That gives SYSTEM, and the researcher says the same trick can get past the self-protection of any antivirus/EDR. Tested by the researcher on Windows 11 26H2 and Windows Server 2025 (Experimental builds); the researcher estimates 80% of Windows installs are affected (an estimate, not a count). The attacker must already be able to run code on the machine. No CVE, no Microsoft advisory, no patch, and no reported attacks yet.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows","fixed":[],"affected":"Windows 11 and Windows Server 2025 with CLFS authentication mitigation","ecosystem":"vendor"},{"name":"Windows Server","fixed":[],"affected":"Windows Server 2025","ecosystem":"vendor"}],"ecosystems":[],"tags":["early-warning","privilege-escalation","technique","windows"],"not_affected_if":[],"how_to_check":"- Read HKLM\\SYSTEM\\CurrentControlSet\\Services\\CLFS\\Authentication\\Mode: per the researcher, 0 or 1 (learning or enforcement mode) is vulnerable; 2 or 3 is not.\n- Affected: Windows with the CLFS authentication mitigation (Windows 11 25H2/26H2, Windows Server 2025 updated on or after 28 Oct 2025).\n- Hunt for unexpected .cnpf/.blf file creation by Windows Defender (MsMpEng.exe) or other SYSTEM processes in user-controlled paths, and for unexpected CLFS errors such as ERROR_LOG_METADATA_CORRUPT.","fix":"- No patch yet; apply Microsoft's fix for clfs.sys as soon as one ships (likely through Patch Tuesday).\n- Do not turn off CLFS authentication to avoid this: it brings back older CLFS memory-corruption exploits.\n- Limit who can run code on important machines (standard accounts, application control), and alert on Defender or EDR processes creating files in odd places.","status":"open","published_at":null,"first_seen_at":"2026-11-12T16:15:14+00:00","triaged_at":"2026-11-12T16:15:14+00:00","updated_at":"2026-11-12T16:15:24+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':33A '10':47B '11':157B '2025':91B,162B '2026':49B '26h2':158B '28':89B '80':168B 'abl':184B 'advisori':195B 'affect':173B 'alreadi':182B 'antivirus/edr':24A,150B 'associ':100B 'attack':104B,180B,201B 'authent':82B,96B 'becom':18A 'bug':74B 'build':164B 'clfs':9A,78B,92B 'clfs.sys':72B 'cnpf':95B 'code':27A,57B,187B 'common':67B 'contain':102B 'count':178B 'creat':93B,128B 'cve':31A,192B 'day':6A 'defend':112B 'driver':11A,71B 'earli':39B 'early-warn':38B 'eclips':52B 'escal':43B,63B 'estim':167B,175B 'experiment':163B 'exploit':26A,56B 'file':69B,81B,97B,126B 'fix':29A 'get':127B,142B 'give':132B 'instal':171B 'let':12A 'link':119B 'local':61B 'log':10A,15A,68B,80B,101B,123B 'log-fil':79B 'logged-in':14A 'machin':190B 'manag':117B 'microsoft':84B,194B 'mitig':83B 'msnightmar':53B 'must':181B 'nightmar':51B 'nov':48B 'object':116B 'oct':90B 'open':121B 'past':143B 'patch':197B 'privileg':42B,62B 'privilege-escal':41B 'protect':147B 'public':25A 'publish':54B 'report':200B 'research':50B,136B,154B,166B 'run':105B,186B 'say':137B 'self':146B 'self-protect':145B 'server':37A,161B 'servermpupdateenginesignatur':114B 'ship':85B 'signdrop':1A,59B 'standard':108B 'switch':22A 'symbol':118B 'system':19A,70B,130B,133B 'tech':32A 'techniqu':44B 'test':151B 'trick':110B,140B 'unpatch':2A 'user':17A,109B 'w4qcgz':34A 'warn':40B 'window':3A,45B,66B,111B,156B,160B,170B 'windows':35A,36A 'work':55B 'yet':202B 'zero':5A 'zero-day':4A","nicknames":["SignDrop"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["server","signdrop","windows","windowsserver"],"ptokens":["server","windows"],"labels":["earlywarning","high","privilegeescalation","technique","vendor","windows"],"campaign_type":"exploitation","search_a":"'-202611':33A 'antivirus/edr':24A 'becom':18A 'clfs':9A 'code':27A 'cve':31A 'day':6A 'driver':11A 'exploit':26A 'fix':29A 'let':12A 'log':10A,15A 'logged-in':14A 'public':25A 'server':37A 'signdrop':1A 'switch':22A 'system':19A 'tech':32A 'unpatch':2A 'user':17A 'w4qcgz':34A 'window':3A 'windows':35A,36A 'zero':5A 'zero-day':4A","search_b":"'10':47B '11':157B '2025':91B,162B '2026':49B '26h2':158B '28':89B '80':168B 'abl':184B 'advisori':195B 'affect':173B 'alreadi':182B 'antivirus/edr':150B 'associ':100B 'attack':104B,180B,201B 'authent':82B,96B 'bug':74B 'build':164B 'clfs':78B,92B 'clfs.sys':72B 'cnpf':95B 'code':57B,187B 'common':67B 'contain':102B 'count':178B 'creat':93B,128B 'cve':192B 'defend':112B 'driver':71B 'earli':39B 'early-warn':38B 'eclips':52B 'escal':43B,63B 'estim':167B,175B 'experiment':163B 'exploit':56B 'file':69B,81B,97B,126B 'get':127B,142B 'give':132B 'instal':171B 'link':119B 'local':61B 'log':68B,80B,101B,123B 'log-fil':79B 'machin':190B 'manag':117B 'microsoft':84B,194B 'mitig':83B 'msnightmar':53B 'must':181B 'nightmar':51B 'nov':48B 'object':116B 'oct':90B 'open':121B 'past':143B 'patch':197B 'privileg':42B,62B 'privilege-escal':41B 'protect':147B 'publish':54B 'report':200B 'research':50B,136B,154B,166B 'run':105B,186B 'say':137B 'self':146B 'self-protect':145B 'server':161B 'servermpupdateenginesignatur':114B 'ship':85B 'signdrop':59B 'standard':108B 'symbol':118B 'system':70B,130B,133B 'techniqu':44B 'test':151B 'trick':110B,140B 'user':109B 'warn':40B 'window':45B,66B,111B,156B,160B,170B 'work':55B 'yet':202B","search_c":"","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":1,"sources":[{"source":"analyst","external_id":"TECH-202611-w4qcgz","url":"https://git.projectnightcrawler.dev/NightmareEclipse/SignDrop/raw/branch/main/README.md","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-12T16:15:14+00:00","fetched_at":"2026-11-12T16:15:14+00:00","note":null,"cites":["https://git.projectnightcrawler.dev/NightmareEclipse/SignDrop/raw/branch/main/README.md","https://cybersecuritynews.com/windows-signdrop-zero-day-exploit/","https://github.com/MSNightmare/SignDrop"]}],"documents":[{"id":136189,"url":"https://www.bleepingcomputer.com/news/security/new-windows-signdrop-zero-day-gives-hackers-system-privileges/","title":"BleepingComputer: New Windows SignDrop zero-day gives hackers SYSTEM privileges","kind":"blog","source":"blog","publisher":null,"text":"New Windows SignDrop zero-day gives hackers SYSTEM privileges\n\nSecurity researcher Abdelhamid Naceri (also known as Nightmare Eclipse) has released a new Windows zero-day exploit that can let attackers gain SYSTEM privileges. [...]","published_at":"2026-11-12T16:04:00+00:00","relation":"describes","confidence":null,"note":null},{"id":136327,"url":"https://git.projectnightcrawler.dev/NightmareEclipse/SignDrop/raw/branch/main/README.md","title":"SignDrop: Windows CLFS Authentication 0day Local Privilege Escalation (README)","kind":"poc","source":"analyst","publisher":null,"text":"SignDrop PoC by Nightmare Eclipse/MSNightmare. Flaw in clfs.sys creation of .cnpf authentication file; Windows Defender coerced via ServerMpUpdateEngineSignature and object manager symlinks to create the file as SYSTEM with original DACL; can also bypass AV/EDR self-protection. Tested on Windows 11 26H2, Windows 11 26H2 Experimental, Windows Server 2025 Experimental. Check HKLM\\SYSTEM\\CurrentControlSet\\Services\\CLFS\\Authentication\\Mode: 0 or 1 vulnerable; 2 or 3 not vulnerable. No fix; disabling mitigation not recommended.","published_at":"2026-11-10T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":136328,"url":"https://cybersecuritynews.com/windows-signdrop-zero-day-exploit/","title":"Windows SignDrop 0-Day Exploit Lets Attackers Gain SYSTEM Privileges Through CLFS Protection","kind":"blog","source":"analyst","publisher":null,"text":"Public PoC SignDrop posted 10 Nov 2026; no CVE, no patch, Microsoft not confirmed; no sign of in-the-wild use. Local privilege escalation in clfs.sys via CLFS authentication (.cnpf). Do not disable CLFS authentication; limit who can run code; watch for odd file creation by Defender or other high-privilege processes; unexpected CLFS errors such as ERROR_LOG_METADATA_CORRUPT.","published_at":"2026-11-11T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":130959,"url":"https://x.com/sans_isc/status/2120698304568967603","title":"@sans_isc: SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119","kind":"post","source":"x","publisher":null,"text":"SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2\n https://t.co/th2uZYzygy https://t.co/M2mJMCfCMz\n\nlikes 3 reposts 1","published_at":"2026-11-12T02:00:51+00:00","relation":"discussion","confidence":null,"note":"@sans_isc"},{"id":135694,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3n24oydfu6c2y","title":"@campuscodi.risky.biz: Security researcher Nightmare Eclipse has released a new Windows zero-day named ","kind":"post","source":"bluesky","publisher":null,"text":"Security researcher Nightmare Eclipse has released a new Windows zero-day named SignDrop\n\nThe zero-day can allow attackers to elevate privileges on Windows systems. It works by exploiting Microsoft's mitigations against CLFS authentication attacks\n\ngithub.com/MSNightmare/...\nhttps://github.com/MSNightmare/SignDrop\n\nlikes 3 reposts 1","published_at":"2026-11-12T14:36:27+00:00","relation":"discussion","confidence":null,"note":"@campuscodi.risky.biz"},{"id":135715,"url":"https://github.com/MSNightmare/SignDrop","title":"SignDrop: Windows CLFS Authentication 0day LPE","kind":"poc","source":"analyst","publisher":null,"text":"README: clfs.sys CLFS authentication mitigation flaw; coerces Windows Defender (ServerMpUpdateEngineSignature) via object manager symlinks to create .cnpf auth file as SYSTEM with original DACL -> SYSTEM shell; can bypass AV/EDR tamper protection. Tested Windows 11 26H2, Server 2025 Experimental. Vulnerable if HKLM\\SYSTEM\\CurrentControlSet\\Services\\CLFS\\Authentication\\Mode is 0 or 1; not vulnerable if 2 or 3. No patch.","published_at":"2026-11-10T00:00:00+00:00","relation":"poc","confidence":null,"note":null},{"id":136325,"url":"https://x.com/BleepinComputer/status/2120910565698650391","title":"@BleepinComputer: New Windows SignDrop zero-day gives hackers SYSTEM privileges\nhttps://t.co/9r7Fy","kind":"post","source":"x","publisher":null,"text":"New Windows SignDrop zero-day gives hackers SYSTEM privileges\nhttps://t.co/9r7FyjnGo1\n\nhttps://t.co/9r7FyjnGo1\n\nlikes 13 reposts 2","published_at":"2026-11-12T16:04:18+00:00","relation":"discussion","confidence":null,"note":"@BleepinComputer"}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://github.com/MSNightmare/SignDrop"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}