VULNpocalypse
MediumVulnerabilityMonitoring

SignDrop Windows CLFS exploit: researcher claims SYSTEM access, no patch

Cyber Security News reports a researcher claims SignDrop gives Windows SYSTEM via CLFS; no CVE or patch, so limit local code execution.

Published
Exploitation
No confirmed exploitation; a review cited by Cyber Security News found no sign of use in real attacks

What happened

According to Cyber Security News, a researcher using the handle MSNightmare, also known as Nightmare Eclipse, posted a public proof-of-concept called SignDrop on GitHub on November 10, 2026. The researcher claims it turns a normal Windows user account into a SYSTEM account by getting around the HMAC protection Microsoft added to the Common Log File System (CLFS).

Cyber Security News reports that the flaw has no CVE number and no patch as of November 11, 2026, and that Microsoft has not confirmed the claims. The researcher says the bug is in clfs.sys, in how the driver creates a .cnpf authentication file when a new log file is made through the exposed \CLFS device. Per the same article, the code uses object manager symbolic links and file timing tricks, and it also claims a high-privilege Windows Defender process can be pushed into creating files in a protected place.

Background given by Cyber Security News: Microsoft added the HMAC to CLFS log files so that CLFS refuses to open files whose code does not match. The change reached Windows 11 25H2 and Windows Server 2025 in updates released on or after October 28, 2025. New systems start in a learning mode that Microsoft says lasts 90 days, then move to enforcement mode on the next driver start. According to the article, MSNightmare says systems are exposed in either mode.

What is not confirmed:

  • Microsoft has not confirmed the claims, and there is no Microsoft advisory.
  • Cyber Security News says a Rocket Boys review found no independent test and no sign of use in real attacks. That review did not run the code itself.
  • The researcher’s estimate that about 80 percent of Windows installations are at risk is an estimate and not a measured count, according to Cyber Security News, which cites Daily Security Review.
  • No fix date is known. The article only says a fix would probably come through a Patch Tuesday update.

Am I affected?

Not confirmed. Per Cyber Security News, the researcher reports testing on Windows 11 26H2 and Windows Server 2025 lab setups. The same article says the Rocket Boys review reports the PoC does not work when CLFS authentication is turned off.

SignDrop is described as a local privilege escalation bug. An attacker would already need to run code on the machine as a normal user, and Cyber Security News says it cannot break in from the internet by itself. Systems where untrusted users or code can run locally are the ones where the claim would matter most.

What to do now

  1. Limit who can run code on important machines and keep standard accounts tightly controlled, as Cyber Security News advises.
  2. Keep Windows updated, and watch for a Microsoft advisory or CVE for this issue. None exists as of the source date.
  3. Watch for odd file creation by Windows Defender or other high-privilege processes.
  4. Look for unexpected CLFS error codes such as ERROR_LOG_METADATA_CORRUPT.
  5. Do not switch off CLFS authentication to avoid this bug. Cyber Security News, citing Microsoft Learn, says the setting is on by default and turning it off lets the driver open and parse any log file, including crafted ones.
  6. If you consider changing CLFS settings, review the fsutil clfs command in Microsoft’s documentation first, as the article suggests.

Sources