Windows Common Log FileSystem Authentication 0day Local Privilege Escalation Vulnerability - MSNightmare/SignDrop

Windows Common Log FileSystem Authentication 0day Local Privilege Escalation Vulnerability - MSNightmare/SignDrop

A public exploit called SignDrop targets a Windows security feature meant to stop attacks on the Common Log File System (CLFS). It claims to turn a normal user account into a SYSTEM account, the highest level of control on Windows. The flaw has no CVE number and no patch as of November 11, 2026. Microsoft has also not confirmed the claims. Windows SignDrop zero-day exploit A researcher using the handle MSNightmare, also known as Nightmare Eclipse, posted the proof-of-concept on GitHub on November 10, 2026. The researcher has a history of public Windows exploit drops. Cyber Security News reported earlier this year that GitLab suspended the account after GitHub’s earlier ban. The researcher says the bug lives in clfs.sys, the kernel driver behind CLFS. It involves how the driver creates a “.cnpf” authentication file when a new log file is made through the exposed \CLFS device. The code uses object manager symbolic links and file timing tricks. It also claims a high-privilege Windows Defender process can be pushed into creating files in a protected place. CLFS Device Object Explorer (Image Source: Nightmare Eclipse) CLFS has long been a favorite target because it parses complex log files inside the kernel. A small mistake there becomes memory corruption, and that can lead to higher privileges. Cyber Security News has covered this pattern many times, including the CVE-2025-29824 zero-day that Storm-2460 used with PipeMagic malware to deploy ransomware. To cut this risk, Microsoft added a hash-based message authentication code (HMAC) to CLFS log files. The code is built from the file data and a secret key unique to each system. If the code does not match, CLFS refuses to open the file, as Microsoft’s support page explains. This change reached Windows 11 25H2 and Windows Server 2025 in updates released on or after October 28, 2025. New systems start in a learning mode, where CLFS adds authentication codes to old log files as they are opened. Microsoft says this period lasts 90 days from the first start with the updated driver. After that, the driver moves to enforcement mode on its next start. This is where the researcher’s claim comes from. MSNightmare says systems are exposed in either mode, so almost any machine older than 90 days would be vulnerable. The researcher also estimates that about 80 percent of Windows installations are at risk. Daily Security Review notes that this number is an estimate and not a measured count. SignDrop SYSTEM Privilege Escalation (Image Source: Nightmare Eclipse) Readers should keep a few limits in mind. SignDrop is a local privilege escalation bug, so an attacker must already run code on the machine as a normal user. It cannot break in from the internet by itself. The Rocket Boys review found no CVE, no Microsoft advisory, no independent test, and no sign of use in real attacks. It also did not run the code itself. The researcher reports testing on Windows 11 26H2 and Windows Server 2025 lab setups. The same review says the PoC does not work when CLFS authentication is turned off. That does not make disabling it a good idea. Do not switch off CLFS authentication to dodge this bug. Microsoft Learn says the setting is on by default, and turning it off lets the driver open and parse any log file, including crafted ones. That would bring back the older CLFS attacks the feature was built to stop. Instead, limit who can run code on important machines, and watch for odd file creation by Defender or other high-privilege processes. Also look for unexpected CLFS error codes such as ERROR_LOG_METADATA_CORRUPT. Admins can review the fsutil clfs command in Microsoft’s documentation before they change any settings. Treat SignDrop as a serious but unconfirmed threat for now. Microsoft will likely review it, and a fix would probably come through a Patch Tuesday update. Until then, the best step is to keep Windows updated and keep standard accounts tightly controlled. Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Windows SignDrop 0-Day Exploit Lets Attackers Gain SYSTEM Privileges Through CLFS Protection appeared first on Cyber Security News .

Nightmare Eclipse（MSNightmare）がWindowsのCLFS認証保護を悪用する新たな権限昇格PoC「SignDrop」をGitHubで公開。コードの概要、SYSTEM権限取得の主張、過去のBlueHammer・RoguePlanet・ShieldBreakとの違い、企業の確認事項を整理します

TL;DR A researcher using the handle MSNightmare published full details and a working proof-of-concept exploit for SignDrop on November 10, 2026. This unpatched Windows CLFS zero-day lets a standard user gain SYSTEM privileges. It abuses the very CLFS authentication mitigation that Microsoft added to block earlier attacks. SignDrop turns Microsoft's CLFS log-file signing feature into a local privilege escalation path. Exploit source code is now public on GitHub, and no patch exists yet.

The researcher Chaotic Eclipse released BigDiskBuster, a PoC exploit for a Windows Defender Update DoS Zero-Day vulnerability.

Nightmare Eclipse has released ShieldCrash, a Microsoft Defender zero-day exploit that grants full System privileges.

The researcher Chaotic Eclipse released ShieldCrash, a PoC exploit for a Microsoft Defender Zero-Day vulnerability.

A newly published proof-of-concept (PoC) called ShieldCrash reveals an unpatched vulnerability in Microsoft Defender that allows a local attacker to gain arbitrary file-read access in the SYSTEM conte...

Chaotic Eclipse released GreenSection, a PoC exploit for an Nvidia Memory Corruption Zero-Day vulnerability.

Nightmare Eclipse has dropped three zero-day exploits targeting Avast, CrowdStrike, and Nvidia products for privilege escalation.

FalconFlank abuses CrowdStrike Falcon's malicious macro remediation to demonstrate local privilege escalation on updated Windows systems.

Chaotic Eclipse released HardBreacher, a PoC exploit for a Kaspersky Endpoint Security privilege escalation flaw.

Chaotic Eclipse released PrettyPrague, a PoC exploit for a GenDigital Avast Antivirus ZeroDay Elevation of Privileges Vulnerability

A proof of concept called HardBreacher allegedly exploits an unpatched local privilege escalation flaw in Kaspersky Antivirus for Endpoint. This vulnerability allows a local user to control a privileg...

Windows Defender Update Denial of Service Vulnerability - MSNightmare/BigDiskBuster

The researcher Chaotic Eclipse released BigDiskBuster, a PoC exploit for a Windows Defender Update DoS Zero-Day vulnerability. Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Microsoft Defender. The researcher named the exploit BigDiskBuster, it triggers a Denial of Service Vulnerability in Windows Defender Update. The security researcher […]

Windows Defender Update Denial of Service Vulnerability

Der unter dem Pseudonym MSNightmare bekannte Sicherheitsforscher Nightmare-Eclipse hat ein Proof-of-Concept-Tool (PoC) namens BigDiskBuster veröffentlicht. Die Technik zielt darauf ab, die Aktualisierung von Microsoft Defender Antivirus zu unterbinden, indem Systemressourcen gezielt blockiert werden. Laut einem Bericht vom 21. September 2026 handelt es sich dabei um eine Denial-of-Service-Methode (DoS), die verhindert, dass das Antivirenprogramm notwendige Plattform- […] The post BigDiskBuster: Neues Tool blockiert Defender-Updates auf Windows appeared first on BornCity.

Windows Defender Update Denial of Service Vulnerability - MSNightmare/BigDiskBuster