--- id: "TECH-202611-w4qcgz" page: "https://infrastack.ai/live/TECH-202611-w4qcgz" kind: "technique" aliases: [] title: "SignDrop: unpatched Windows zero-day in the CLFS log driver lets any logged-in user become SYSTEM and can switch off antivirus/EDR (public exploit code, no fix, no CVE)" severity: "high" cvss: null epss: null exploited: false status: "open" category: "vendor" products: [{"name": "Windows", "fixed": [], "affected": "Windows 11 and Windows Server 2025 with CLFS authentication mitigation", "ecosystem": "vendor"}, {"name": "Windows Server", "fixed": [], "affected": "Windows Server 2025", "ecosystem": "vendor"}] ecosystems: [] tags: ["early-warning", "privilege-escalation", "technique", "windows"] not_affected_if: [] published_at: null first_seen_at: "2026-11-12T16:15:14+00:00" updated_at: "2026-11-12T16:15:24+00:00" sources: [{"source": "analyst", "url": "https://git.projectnightcrawler.dev/NightmareEclipse/SignDrop/raw/branch/main/README.md", "first_seen_at": "2026-11-12T16:15:14+00:00", "cites": ["https://git.projectnightcrawler.dev/NightmareEclipse/SignDrop/raw/branch/main/README.md", "https://cybersecuritynews.com/windows-signdrop-zero-day-exploit/", "https://github.com/MSNightmare/SignDrop"]}] exploit_sources: [{"type": "poc", "url": "https://github.com/MSNightmare/SignDrop"}] --- # SignDrop: unpatched Windows zero-day in the CLFS log driver lets any logged-in user become SYSTEM and can switch off antivirus/EDR (public exploit code, no fix, no CVE) Link for people: https://infrastack.ai/live/TECH-202611-w4qcgz (this .md is for agents) On 10 Nov 2026 researcher Nightmare Eclipse (MSNightmare) published working exploit code for SignDrop, a local privilege escalation in the Windows Common Log File System driver (clfs.sys). The bug is in the CLFS log-file authentication mitigation Microsoft shipped on or after 28 Oct 2025. CLFS creates a .cnpf authentication file for an associated log container. An attacker running as a standard user tricks Windows Defender (through ServerMpUpdateEngineSignature and object manager symbolic links) into opening the log, so the file gets created as SYSTEM. That gives SYSTEM, and the researcher says the same trick can get past the self-protection of any antivirus/EDR. Tested by the researcher on Windows 11 26H2 and Windows Server 2025 (Experimental builds); the researcher estimates 80% of Windows installs are affected (an estimate, not a count). The attacker must already be able to run code on the machine. No CVE, no Microsoft advisory, no patch, and no reported attacks yet. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Windows affected Windows 11 and Windows Server 2025 with CLFS authentication mitigation fixed no fixed version listed - vendor:Windows Server affected Windows Server 2025 fixed no fixed version listed ## How to check - Read HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode: per the researcher, 0 or 1 (learning or enforcement mode) is vulnerable; 2 or 3 is not. - Affected: Windows with the CLFS authentication mitigation (Windows 11 25H2/26H2, Windows Server 2025 updated on or after 28 Oct 2025). - Hunt for unexpected .cnpf/.blf file creation by Windows Defender (MsMpEng.exe) or other SYSTEM processes in user-controlled paths, and for unexpected CLFS errors such as ERROR_LOG_METADATA_CORRUPT. ## Fix - No patch yet; apply Microsoft's fix for clfs.sys as soon as one ships (likely through Patch Tuesday). - Do not turn off CLFS authentication to avoid this: it brings back older CLFS memory-corruption exploits. - Limit who can run code on important machines (standard accounts, application control), and alert on Defender or EDR processes creating files in odd places. ## Timeline - 2026-11-12T16:15:14+00:00 analyst https://git.projectnightcrawler.dev/NightmareEclipse/SignDrop/raw/branch/main/README.md ## Documents - [describes] BleepingComputer: New Windows SignDrop zero-day gives hackers SYSTEM privileges https://www.bleepingcomputer.com/news/security/new-windows-signdrop-zero-day-gives-hackers-system-privileges/ - [describes] SignDrop: Windows CLFS Authentication 0day Local Privilege Escalation (README) https://git.projectnightcrawler.dev/NightmareEclipse/SignDrop/raw/branch/main/README.md - [describes] Windows SignDrop 0-Day Exploit Lets Attackers Gain SYSTEM Privileges Through CLFS Protection https://cybersecuritynews.com/windows-signdrop-zero-day-exploit/ - [discussion] @sans_isc: SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119 https://x.com/sans_isc/status/2120698304568967603 - [discussion] @campuscodi.risky.biz: Security researcher Nightmare Eclipse has released a new Windows zero-day named https://bsky.app/profile/campuscodi.risky.biz/post/3n24oydfu6c2y - [discussion] @BleepinComputer: New Windows SignDrop zero-day gives hackers SYSTEM privileges https://t.co/9r7Fy https://x.com/BleepinComputer/status/2120910565698650391 - [poc] SignDrop: Windows CLFS Authentication 0day LPE https://github.com/MSNightmare/SignDrop --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_