SignDrop Windows CLFS Zero-Day Gives SYSTEM Access

A researcher known as Chaotic Eclipse has published a working exploit for SignDrop, an unpatched Windows zero-day that lets a standard user gain SYSTEM privileges by turning Microsoft’s own Common Log File System (CLFS) security feature against itself.

SignDrop is a local privilege-escalation flaw in clfs.sys, the kernel driver that implements CLFS. It has no CVE ID and no CVSS score, and as of November 11, 2026, Microsoft has not published an advisory or a fix.

The researcher, who also uses the handles Nightmare-Eclipse and MSNightmare, posted the SignDrop proof-of-concept on GitHub on Tuesday, November 10, 2026, with no coordinated disclosure. The repository ships C++ source and a Visual Studio project, and the researcher says a successful run “spawns a SYSTEM shell.”

SignDrop abuses a mitigation Microsoft built to curb CLFS attacks. The CLFS authentication mitigation adds a hash-based message authentication code (HMAC) to each log file and stores it in a “.cnpf” file beside the log, so the kernel can reject tampered logs. SignDrop turns that signing step into a path to privilege escalation.

How SignDrop Works

According to the researcher, the flaw lies in how clfs.sys creates the .cnpf signature file. When a standard user creates a log and a privileged process later opens it, CLFS creates the missing signature file for that privileged process rather than for the user. The proof-of-concept coerces the Microsoft Defender antimalware engine into opening the log, so the file is written as SYSTEM and inherits the original file’s permissions. “Everything is done properly by Microsoft here but the logic allows abuse,” the researcher wrote.

The researcher also claims the technique can disable other antivirus and EDR products, because the file-creation request appears to come from the security tool’s own trusted process — a claim Cyber Kendra could not independently verify.

The CLFS authentication mitigation reached Windows 11 version 25H2 and Windows Server 2025 in updates released on or after October 28, 2025, so only systems where it is active are exposed. The researcher says machines in both the 90-day “learning” mode and later “enforcement” mode are affected, and estimates “80% of the world’s windows installations are vulnerable” — a figure offered without supporting data. The exploit was tested on Windows 11 26H2 and experimental Windows Server 2025 builds.

What Admins Should Do Now

There are no reports of SignDrop being used in attacks as of November 11, 2026, and it is not in CISA’s Known Exploited Vulnerabilities catalog. As a local privilege escalation bug, it requires an attacker to already run code on the machine as a normal user.

No patch exists, and both the researcher and Microsoft’s guidance warn against disabling the CLFS mitigation to dodge SignDrop, since that re-exposes machines to the older CLFS memory-corruption bugs it was built to stop. Until a fix ships, defenders should enforce least privilege on standard accounts and watch for unexpected .cnpf creation by privileged processes and unusual CLFS errors, such as ERROR_LOG_METADATA_CORRUPT. Chaotic Eclipse has dropped a string of unpatched Windows exploits since BlueHammer in April 2026, several of which were later abused in the wild, so patch promptly once Microsoft responds.