A newly disclosed Windows zero-day exploit known as SignDrop could allow attackers with standard user privileges to gain complete SYSTEM-level access by abusing a security feature within Microsoft‘s Common Log File System (CLFS) driver.

The proof-of-concept exploit, released publicly earlier this week, targets the way Windows creates companion files when privileged processes access specially prepared log files.

The vulnerability reportedly allows an attacker to manipulate file creation paths and cause a privileged Windows process to create a file that the attacker can subsequently modify, potentially opening the door to full SYSTEM privileges.

The researcher behind the exploit, who operates under the name MSNightmare, published the proof-of-concept code alongside a technical explanation on GitHub on Tuesday, November 10, the same day Microsoft released its November security updates.

Microsoft has not officially confirmed the reported vulnerability, assigned it a CVE identifier or released a security patch specifically addressing SignDrop.

The Common Log File System is a Windows logging component responsible for managing application and system log data. Its kernel driver, clfs.sys, has repeatedly attracted security researchers and attackers because weaknesses in the component can provide opportunities for privilege escalation.

According to the report, 10 CLFS-related vulnerabilities have already been included in the US Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities catalogue, including a flaw previously used in ransomware attacks in April 2025.

To strengthen the security of the subsystem, Microsoft introduced an authentication mechanism for CLFS log files through updates released in October 2025 for Windows 11 versions 25H2 and 26H1, as well as Windows Server 2025.

The protection uses a hash-based message authentication code generated from log information and a machine-specific cryptographic key.

The mechanism is designed to ensure that the CLFS driver only processes log files that were legitimately created and authenticated by the system.

As part of the protection, Windows creates an accompanying .cnpf file containing recovery information alongside each log file. The companion file inherits the same security permissions as the original log, according to Microsoft’s technical documentation.

However, SignDrop reportedly exploits the process used to create this companion file.

According to the published proof-of-concept, an attacker operating with ordinary user privileges first prepares a CLFS log and container using file paths under their control.

When a privileged process subsequently opens the specially prepared log, the CLFS driver creates the accompanying .cnpf file within the security context of that privileged process rather than the original user.

The exploit then abuses Windows Object Manager symbolic links to redirect the file creation operation to a location selected by the attacker.

In the publicly released demonstration, the privileged process involved is Microsoft’s Defender antimalware service, which can be triggered through its update interface.

The researcher explained that although Microsoft implemented the authentication mechanism correctly, the underlying file-creation logic still creates an opportunity for abuse.

Because the companion file inherits the original log’s permissions, the resulting file can be created with SYSTEM-level privileges while remaining writable by the standard user who prepared the original log.

The researcher said this behaviour could be exploited as part of a chain that ultimately provides an attacker with a SYSTEM shell, the highest privilege level in Windows.

SignDrop Tested Against Windows 11 and Windows Server 2025

The exploit repository identifies several tested environments, including Windows 11 26H2, an experimental Windows 11 26H2 build and an experimental Windows Server 2025 installation.

According to the researcher, the affected configurations include systems where the CLFS authentication registry mode is set to either 0, representing enforcement, or 1, representing learning mode.

The report explained that installations operating in learning mode for more than 90 days generally transition automatically to enforcement.

This means that established Windows installations using the default security configuration could fall within the exploit’s claimed attack surface.

However, systems configured with registry values of 2 or 3 have the CLFS authentication mitigation disabled and are reportedly outside the specific attack conditions described by the researcher.

Disabling the protection is not recommended because it allows CLFS to process potentially tampered log files, reintroducing exposure to memory corruption vulnerabilities that the authentication mechanism was designed to prevent.

Independent Security Researcher Confirms Exploit Works

An independent assessment conducted by Sungyup Nam, head of research at South Korean cybersecurity firm 78researchlab, has also examined the SignDrop exploit.

Nam disclosed that Heewon Song, a researcher from the company’s PurpleHound offensive research team, tested the proof-of-concept and confirmed that the technique works.

However, the assessment noted that the exploit was not sufficiently reliable for practical operational use.

The published exploit also requires Microsoft Defender to remain enabled for the demonstrated attack chain to function.

Furthermore, executing the exploit reportedly changes every User Account Control (UAC) prompt to open both a standard-user shell and a SYSTEM shell.

This behaviour can interfere with other operations and make the attack noticeable to anyone monitoring activity on the affected computer.

Although the researcher suggested that the technique could potentially work against other antimalware products whose processes operate with elevated privileges, that broader capability has not been independently demonstrated.

No Microsoft Patch or CVE Assigned Yet

As of the November 2026 security update release, Microsoft has not published a specific advisory or patch addressing the SignDrop vulnerability.

The issue is also absent from CISA’s Known Exploited Vulnerabilities catalogue, and there have been no confirmed reports of the exploit being used in real-world attacks.

Windows administrators can examine their systems by checking the CLFS authentication configuration in the Windows Registry at:

HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication

A registry value of 0 or 1 indicates a configuration within the researcher’s claimed scope.

Administrators are advised to consult Microsoft’s official CLFS authentication mitigation guidance before making changes to the configuration. Disabling the protection could expose systems to other known security weaknesses.

Researcher Previously Disclosed Other Microsoft Defender Exploits

SignDrop is the latest in a series of Windows and Microsoft Defender security exploits disclosed by MSNightmare since April 2026.

One earlier vulnerability, identified as RoguePlanet, was confirmed by Microsoft in June and assigned the identifier CVE-2026-50656. The company subsequently released a fix in July.

Another exploit, known as ShieldBreak, emerged in August and received the identifier CVE-2026-69414.

The researcher has previously disclosed three Defender-related vulnerabilities that were subsequently exploited in cyberattacks.

However, SignDrop differs from those earlier discoveries because it targets the authentication and file-creation mechanisms within the CLFS driver rather than race conditions associated with Microsoft Defender’s file-handling operations.

Security researchers are therefore monitoring Microsoft’s response to determine whether the newly disclosed technique will require changes to the CLFS driver or additional protections within Windows.

For now, system administrators are advised to maintain existing security protections, monitor Microsoft’s Security Update Guide for an official response and avoid disabling CLFS authentication as a workaround.