Windows CLFS: unpatched SignDrop zero-day grants SYSTEM and reportedly bypasses tamper protection

Severity: high · Patch status: unpatched · Since 2026-11-12

On 2026-11-12 BleepingComputer reported that Abdelhamid Naceri (publishing as Nightmare Eclipse) released a public proof-of-concept named SignDrop for a Windows local privilege escalation to SYSTEM. The researcher says it abuses the CLFS authentication mitigation Microsoft introduced in October 2025: when a privileged process such as Windows Defender is made to open a log file, the .cnpf authentication file is created with SYSTEM privileges while inheriting the original file's access permissions, and he says this also gets past antimalware tamper protection. He reports testing on Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental, and estimates that 80% of Windows installations are vulnerable; those figures are his and are not independently verified. No CVE and no Microsoft patch were reported, and the researcher says the only fix is waiting for one. He also says disabling the CLFS mitigation would re-expose systems to CLFS memory corruption attacks, so it should stay on. No in-the-wild exploitation has been reported. He has published several earlier Windows zero-days without private reporting, and Microsoft has fixed some of them.

What to do

Check HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode; the researcher says values 0 (learning) or 1 (enforcement) indicate exposure (his claim, not independently verified)
Do not run the public PoC on production or corporate endpoints; treat it as hostile code and block or alert on its execution
Apply Microsoft's patch as soon as it is released; monitor for the fix
Do not disable the CLFS mitigation, as this would re-expose systems to CLFS memory corruption exploits
Monitor privileged processes (e.g., Defender) for unexpected file creation in log directories and watch for tamper-protection bypass attempts
Restrict which processes can open CLFS log files where feasible

Sources

New Windows SignDrop zero-day gives hackers SYSTEM privileges (bleepingcomputer.com)

All live incidents on Threat Watch

Threat Watch– active

All incidents

More on Threat Watch

More Microsoft incidents

Browse

Helix Cyber

Is your stack exposed? Get it tested.

The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.

Get a pentest How it works

Agent Virtualization

Enterprise Coding Agents

Private AI Platform

Digital Sovereignty

Follow the Sun

The Speed Advantage

Financial Services

GPU Cloud & Neoclouds

Public Sector & Defence

More on Threat Watch

More Microsoft incidents

Browse

Is your stack exposed? Get it tested.