SignDrop: unpatched Windows CLFS zero-day gives SYSTEM, no CVE or fix yet

SignDrop is a publicly released Windows exploit that, according to the researcher who published it, lets a standard user become SYSTEM on machines where Microsoft's newer CLFS log-file authentication is active. It has no CVE and no patch as of the latest reports we found, and it turns a Microsoft hardening feature into the way in. It is a local privilege escalation: an attacker needs to be running code on the machine already. That still matters, because chaining a local bug to a phishing or malware foothold is how many intrusions deepen.

Key points

• A researcher using the handles Nightmare-Eclipse and MSNightmare published the SignDrop proof of concept on GitHub on 10 November 2026, with no coordinated disclosure, according to Cyderes and Cyber Kendra.
• SignDrop abuses the CLFS authentication mitigation Microsoft added in October 2025, which signs log files with an HMAC stored in a .cnpf file, per BleepingComputer and Cyber Kendra.
• There is no CVE, no Microsoft advisory and no patch in the reports we read (Cyderes and Cyber Kendra, 11 November); we found no Microsoft statement about SignDrop.
• The researcher claims about 80% of Windows installations are vulnerable; Cyderes calls that figure unsubstantiated.
• Cyderes says it reproduced a SYSTEM shell, and reports no confirmed in-the-wild exploitation as of 10 November; Cyber Kendra found none as of 11 November.

What to do

There is no vendor fix to install, so the steps are about reducing exposure and watching.

• Who is affected. Systems where CLFS authentication is active. Cyber Kendra says the mitigation reached Windows 11 version 25H2 and Windows Server 2025 in updates released on or after 28 October 2025. The researcher says he tested Windows 11 26H2 and Windows Server 2025 builds (BleepingComputer). Cyderes says systems with the CLFS authentication registry key set to Mode 0 (enforcement) or Mode 1 (learning) are in scope.
• Do not turn the mitigation off. The researcher, Cyderes and Cyber Kendra all note that disabling CLFS authentication re-exposes machines to the older memory-corruption bugs it was built to stop.
• Do not test your own machines by running the published exploit. BleepingComputer relays the researcher's suggestion to run the proof of concept as a check, but unvetted exploit code from the internet is itself a risk. If you need to know whether you are in scope, read the CLFS authentication mode value under HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication (a read-only check) and compare it with the modes above. That reading of the registry value follows the reports; it is not a confirmed vulnerability test, and one commenter under BleepingComputer's story reports a value of 3, which no report explains.
• Reduce the chance an attacker gets a foothold. Cyber Kendra advises enforcing least privilege on standard accounts.
• Hunt. Cyber Kendra suggests watching for unexpected .cnpf file creation by privileged processes and unusual CLFS errors such as ERROR_LOG_METADATA_CORRUPT.
• Patch promptly when Microsoft responds, and keep up with the November updates already out: see our Patch Tuesday outlook for KB5132061.

What happened

According to Cyderes' Howler Cell team and Cyber Kendra, the researcher posted SignDrop on GitHub on Tuesday 10 November 2026, the same day as November Patch Tuesday. The repository ships source code and a Visual Studio project. BleepingComputer reported on 12 November.

The flaw lies in how the Common Log File System (CLFS) driver creates the authentication file for a new log. The researcher says access checks are enforced correctly at the start, but the logic can be abused when a different, privileged process later opens the log. Cyber Kendra puts it this way: when a standard user creates a log and a privileged process opens it, CLFS creates the missing signature file for that privileged process, not for the user. The proof of concept gets Microsoft Defender to be that privileged process, so the file is created as SYSTEM and inherits the original file's permissions.

We are deliberately not describing the exploit chain step by step. Cyderes, which published a full technical analysis, says the chain uses no memory corruption: it strings together legitimate Windows subsystems and an internal Defender interface, and ends with a SYSTEM console on the user's desktop. Howler Cell says its own reproduction produced a SYSTEM shell.

The researcher adds a second claim: because the file-creation request appears to come from an antimalware engine's own process, the technique could be used to turn off other antivirus and EDR products. Cyber Kendra says it could not independently verify that claim, and we could not either.

Background

CLFS is the kernel logging component behind a long line of Windows privilege-escalation bugs. Cyderes says logic bugs from improper validation of CLFS data structures accounted for 19 of 24 CLFS CVEs over five years. Microsoft responded by adding HMAC-based authentication to log files, in updates released from 28 October 2025 according to Cyber Kendra, with a learning period of about 90 days before enforcement.

The researcher behind SignDrop has been prolific. Cyderes counts sixteen public zero-day releases in roughly thirty-one weeks, starting on 3 April 2026 with names including BlueHammer, RedSun, YellowKey, MiniPlasma, ShieldBreak and ShieldCrash. BleepingComputer says Microsoft has fixed some of these (ShieldBreak, RoguePlanet, YellowKey, GreenPlasma and MiniPlasma) while others still lack an official patch. Cyber Kendra says several of the releases were later abused in the wild. Cyderes notes the first public release it could not reproduce was ShieldCrash, so these claims are not all equal.

BleepingComputer adds the history: after earlier releases years ago, Microsoft warned of legal action against anyone engaging in "malicious activity causing real harm" to its customers, which many in the infosec community read as a threat to the researcher. We note this only as BleepingComputer's account.

type: bar
title: CLFS CVEs over five years, by cause (Howler Cell's count)
unit: CVEs
source: Cyderes Howler Cell, SignDrop analysis
highlight: Improper validation of CLFS data structures
Improper validation of CLFS data structures | 19
All other CLFS CVEs | 5

How it works

At a high level, SignDrop is a logic flaw rather than a memory bug. The mitigation exists so the kernel can reject tampered logs: it stores an HMAC beside each log in a .cnpf file. SignDrop makes the kernel create that signature file in a privileged context at a location the attacker influences, and the resulting file keeps attacker-accessible permissions. From there Cyderes says the exploit swaps the content and uses ordinary Windows loading behaviour to get code running as SYSTEM.

Two things follow. First, it needs local code execution, so it is a second-stage tool, not a remote attack. Second, a fix is not simple: Cyderes points out that Microsoft cannot switch off its own hardening and has to fix the logic itself.

What it means

For administrators, SignDrop is another reason to keep standard users from running arbitrary code and to rely on host telemetry that does not assume the security agent is always behaving as designed. For EDR and antivirus vendors, the researcher's claim that self-protection can be bypassed, if true, is more serious than the single exploit, but it is unverified.

For Microsoft, the pressure is the pace: Cyderes says the series has moved from Defender features to a kernel mitigation, with a public actor turning security mechanisms into attack surface faster than the vendor can close them.

What we don't know yet

• When or whether Microsoft will patch it. We found no advisory, CVE or statement.
• How many systems are really exposed. The 80% figure is the researcher's own estimate, with no supporting data according to Cyderes and Cyber Kendra.
• Whether it works against other security products. Unverified (Cyber Kendra).
• Whether it is exploited in attacks. None confirmed as of the dates in the reports.
• What a Mode 3 reading means. One reader reports it and no source explains it.

What to watch next

Watch for a Microsoft advisory or CVE, the December Patch Tuesday, CISA's Known Exploited Vulnerabilities catalog, and whether security vendors say their self-protection is affected. We will add an update if Microsoft responds.

Sources

• Cyderes Howler Cell: SignDrop zero-day turns Windows CLFS defense into privilege escalation (technical analysis, 12 November 2026)
• BleepingComputer: New Windows SignDrop zero-day gives hackers SYSTEM privileges
• Cyber Kendra: SignDrop Windows CLFS zero-day gives SYSTEM access