SignDrop Windows zero-day can give a local user full control of some Windows 11 26H2 PCs, and there's no patch yet

A public exploit called SignDrop abuses a Windows Common Log File System safeguard and Microsoft Defender to turn a standard user into SYSTEM. Will Dormann reproduced it, but only on Windows 11 26H2 machines that have run the safeguard for more than 90 days. Microsoft has no CVE, advisory or fix, and no attacks are reported. How to check a PC, and why you shouldn't switch the safeguard off.

If your company runs Windows 11 version 26H2, check whether its PCs are in the narrow group a new public exploit can take over, and leave the Windows safeguard it abuses switched on. The exploit, called SignDrop, lets someone with an ordinary user account gain SYSTEM rights, the highest level on a Windows PC. Code to run it is public. Microsoft has not assigned a CVE, published an advisory or shipped a fix, and no attacks using it have been reported.

A 2025 safeguard is what gets abused

The researcher known as Nightmare Eclipse, who publishes on GitHub as MSNightmare, released SignDrop with a detailed writeup on November 10, the same day as Microsoft’s November security updates, according to The Hacker News and Ars Technica. It targets the Common Log File System (CLFS), a logging service built into Windows.

Microsoft added logfile authentication to CLFS in October 2025 to stop attackers from feeding the driver tampered logs, a common route in earlier attacks. Each log gets a companion .cnpf recovery file, which Microsoft’s CLFS authentication documentation says gets the same security settings as the log it belongs to. SignDrop prepares a log in a folder the user controls, then makes Microsoft Defender open it through Defender’s signature-update function. The companion file gets created with Defender’s SYSTEM privileges but with the user’s permissions, and a redirect points that file wherever the attacker wants. The researcher says this can be chained into a SYSTEM command prompt.

“Everything is done properly by Microsoft here but the logic allows abuse,” the researcher wrote, as quoted by both outlets.

Who is exposed, as far as anyone has shown

• Windows 11 26H2. The researcher tested Windows 11 26H2, a 26H2 Experimental build and a Windows Server 2025 Experimental build. Will Dormann, a vulnerability analyst, told Ars he reproduced the exploit and it works as described, but only on some machines. He said it appears to need a Windows 11 26H2 installation that has existed for more than 90 days, so a freshly installed and updated 26H2 PC won’t do. Of the many machines he uses, one met the requirement.
• The CLFS mode setting. The exploit needs the registry value Mode under HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication set to 0 (enforced) or 1 (learning), according to the researcher and Dormann. Microsoft’s documentation says the driver starts in learning mode after the update and switches to enforcement once its adoption period ends, which The Hacker News describes as about 90 days.
• Defender turned on. The published chain uses Defender as the privileged process, so it needs Defender running, The Hacker News reports.
• Noisy and unreliable so far. Running it changes every UAC prompt on the PC, which a person at the machine would notice. A researcher at Korean security firm 78researchlab confirmed it works but judged it not reliable enough for real attacks, The Hacker News reports.

The researcher also claims the same trick can switch off any antivirus or EDR product, because the file creation appears to come from the security product’s own process. Nobody has tested that claim independently.

What to do this week

• Find out who runs 26H2. Type winver in Start to see the version. Ars notes Microsoft rolls 26H2 out in stages, so a fleet can be mixed. So far nobody has shown the exploit working on other versions.
• Check the mode on 26H2 PCs. In a Command Prompt, run reg query HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication /v Mode. A value of 0 or 1 matches the conditions the researcher describes.
• Don’t switch the safeguard off. Setting Mode to 2 disables logfile authentication and takes a PC outside SignDrop’s described conditions. Microsoft’s documentation calls that not recommended, because CLFS then reads logfiles that may be corrupted or malicious. That reopens the older CLFS bugs the safeguard was built to block.
• Watch for Microsoft’s fix. Check the Microsoft Security Update Guide for a SignDrop advisory and install it when it lands. The next Patch Tuesday is December 8. Keep this month’s updates installed meanwhile: they fix an Outlook flaw already under attack, covered in our November Patch Tuesday rundown.

It only matters after someone is already on the PC

This is our analysis. SignDrop is a local privilege escalation bug: it does nothing until an attacker can run code as a normal user, usually through a phishing attachment or a malicious download. What it adds is the second step, from one user’s files to the whole machine, where an attacker can turn off protections and reach other accounts. For a small team, the controls that matter most right now are the ones that stop the first step: people work in standard accounts, unknown executables don’t run, and Defender stays on. Microsoft has fixed this researcher’s earlier finds. It confirmed an earlier Defender exploit, RoguePlanet, as CVE-2026-50656 and patched it a month later, and an August bypass called ShieldBreak became CVE-2026-69414, according to The Hacker News. Microsoft didn’t respond to Ars’ request for comment.

Primary source: Microsoft, CLFS logfile authentication documentation. Reported by Ars Technica (including Will Dormann’s reproduction) and The Hacker News.