A public exploit called SignDrop targets a Windows security feature meant to stop attacks on the Common Log File System (CLFS). It claims to turn a normal user account into a SYSTEM account, the highest level of control on Windows. The flaw has no CVE number and no patch as of November 11, 2026. Microsoft has also not confirmed the claims. Windows SignDrop zero-day exploit A researcher using the handle MSNightmare, also known as Nightmare Eclipse, posted the proof-of-concept on GitHub on November 10, 2026. The researcher has a history of public Windows exploit drops. Cyber Security News reported earlier this year that GitLab suspended the account after GitHub’s earlier ban. The researcher says the bug lives in clfs.sys, the kernel driver behind CLFS. It involves how the driver creates a “.cnpf” authentication file when a new log file is made through the exposed \CLFS device. The code uses object manager symbolic links and file timing tricks. It also claims a high-privilege Windows Defender process can be pushed into creating files in a protected place. CLFS Device Object Explorer (Image Source: Nightmare Eclipse) CLFS has long been a favorite target because it parses complex log files inside the kernel. A small mistake there becomes memory corruption, and that can lead to higher privileges. Cyber Security News has covered this pattern many times, including the CVE-2025-29824 zero-day that Storm-2460 used with PipeMagic malware to deploy ransomware. To cut this risk, Microsoft added a hash-based message authentication code (HMAC) to CLFS log files. The code is built from the file data and a secret key unique to each system. If the code does not match, CLFS refuses to open the file, as Microsoft’s support page explains. This change reached Windows 11 25H2 and Windows Server 2025 in updates released on or after October 28, 2025. New systems start in a learning mode, where CLFS adds authentication codes to old log files as they are opened. Microsoft says this period lasts 90 days from the first start with the updated driver. After that, the driver moves to enforcement mode on its next start. This is where the researcher’s claim comes from. MSNightmare says systems are exposed in either mode, so almost any machine older than 90 days would be vulnerable. The researcher also estimates that about 80 percent of Windows installations are at risk. Daily Security Review notes that this number is an estimate and not a measured count. SignDrop SYSTEM Privilege Escalation (Image Source: Nightmare Eclipse) Readers should keep a few limits in mind. SignDrop is a local privilege escalation bug, so an attacker must already run code on the machine as a normal user. It cannot break in from the internet by itself. The Rocket Boys review found no CVE, no Microsoft advisory, no independent test, and no sign of use in real attacks. It also did not run the code itself. The researcher reports testing on Windows 11 26H2 and Windows Server 2025 lab setups. The same review says the PoC does not work when CLFS authentication is turned off. That does not make disabling it a good idea. Do not switch off CLFS authentication to dodge this bug. Microsoft Learn says the setting is on by default, and turning it off lets the driver open and parse any log file, including crafted ones. That would bring back the older CLFS attacks the feature was built to stop. Instead, limit who can run code on important machines, and watch for odd file creation by Defender or other high-privilege processes. Also look for unexpected CLFS error codes such as ERROR_LOG_METADATA_CORRUPT. Admins can review the fsutil clfs command in Microsoft’s documentation before they change any settings. Treat SignDrop as a serious but unconfirmed threat for now. Microsoft will likely review it, and a fix would probably come through a Patch Tuesday update. Until then, the best step is to keep Windows updated and keep standard accounts tightly controlled. Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Windows SignDrop 0-Day Exploit Lets Attackers Gain SYSTEM Privileges Through CLFS Protection appeared first on Cyber Security News .

TL;DR A researcher using the handle MSNightmare published full details and a working proof-of-concept exploit for SignDrop on November 10, 2026. This unpatched Windows CLFS zero-day lets a standard user gain SYSTEM privileges. It abuses the very CLFS authentication mitigation that Microsoft added to block earlier attacks. SignDrop turns Microsoft's CLFS log-file signing feature into a local privilege escalation path. Exploit source code is now public on GitHub, and no patch exists yet.

A public exploit called SignDrop targets a Windows security feature meant to stop attacks on the Common Log File System (CLFS). It claims to turn a normal user account into a SYSTEM account, the highe...

Erfahren Sie mehr über SignDrop und die ungepatchte Windows-Schwachstelle, die eine lokale Rechteausweitung ermöglicht.

A public exploit called SignDrop targets a Windows security feature meant to stop attacks on the Common Log File System (CLFS). It claims to turn a normal user account into a SYSTEM account, the highest level…

Nightmare Eclipse（MSNightmare）がWindowsのCLFS認証保護を悪用する新たな権限昇格PoC「SignDrop」をGitHubで公開。コードの概要、SYSTEM権限取得の主張、過去のBlueHammer・RoguePlanet・ShieldBreakとの違い、企業の確認事項を整理します

Windows Common Log FileSystem Authentication 0day Local Privilege Escalation Vulnerability - MSNightmare/SignDrop

PAMA 2027 CLFS Rate Changes — Impact on Labs by 2024 Medicare Test Mix