SignDrop: unpatched Windows CLFS zero-day gives local users SYSTEM, public exploit available, no CVE or patch
Matéria consolidada. Reúne 8 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 6 fontes trouxeram em 13/11/2026 12:04; os links antigos trazem para cá.
Fontes: securityaffairs.com ↗ securityweek.com ↗ thehackernews.com ↗ bleepingcomputer.com ↗ gbhackers.com ↗ securityonline.info ↗
A researcher known as MSNightmare (aka Chaotic Eclipse, identified by bleepingcomputer.com and securityweek.com as Abdelhamid Naceri, known as Nightmare Eclipse per securityweek.com) disclosed SignDrop, an unpatched local privilege escalation zero-day in the Windows Common Log File System (CLFS) driver (clfs.sys). It lets a standard user obtain NT AUTHORITY\SYSTEM (gbhackers.com). A proof-of-concept exploit and a detailed writeup are public (securityonline.info, thehackernews.com), and the exploit spawns a SYSTEM shell on Windows 11 26H2 and Windows Server builds (securityonline.info). As of 2026-11-13, no CVE or patch has been issued. Microsoft has neither confirmed the issue nor commented publicly; securityweek.com says it was contacted for comment and has not yet issued a statement (securityonline.info, gbhackers.com, thehackernews.com). No in-the-wild exploitation has been reported (thehackernews.com, securityweek.com). The flaw is local-only, so an attacker needs prior code execution, which makes it a likely second-stage step after phishing or malware (gbhackers.com). The flaw abuses the CLFS authentication mitigations Microsoft introduced in October 2025 (bleepingcomputer.com), exploiting a design issue in the staged rollout of CLFS authentication (securityaffairs.com).
Entenda a falha
A vulnerabilidade
SignDrop is an unpatched local privilege escalation zero-day in the Windows Common Log File System driver (clfs.sys), with no CVE and no advisory as of November 13, 2026. An attacker needs code execution as a standard user, and Defender must be enabled for the published chain. The result is NT AUTHORITY\SYSTEM. Exposure depends on the CLFS authentication mitigation Microsoft added in October 2025 (25H2, 26H1, Server 2025). Systems with registry Mode 0 or 1 are affected; 2 or 3 is outside the attack surface but reopens CLFS memory-corruption bugs. It was tested on Windows 11 26H2 and on 26H2 Experimental and Server 2025 Experimental builds. The researcher estimates 80% of installations are exposed, with no data behind the figure. No fix exists.
Como funciona
When a CLFS log is created, the driver writes a companion ".cnpf" authentication file beside it. A log can have an associated container, and opening the original log always opens that container too. If the container is empty, CLFS signs it whether or not a signature file already exists. When the caller is the user's own process this is harmless, because file creation uses the caller's context and access checks. A standard user can prepare a log whose container path they control and then get a privileged process to open it. According to the researcher, Defender is driven to do this through ServerMpUpdateEngineSignature, with object manager symbolic links redirecting the path. CLFS then creates the missing authentication file in the privileged context, and the file inherits the original file's DACL, so the user can still write to a SYSTEM-created file.
Por que é vulnerável
The root cause is a logic flaw, not a classic memory bug. The researcher ties it to the staged rollout of CLFS authentication (a 90-day learning phase, then enforcement). CLFS signs an empty associated container regardless of who opened the log. Anyone who knows a log's path can open it, so a privileged process can be made to act on files an attacker prepared. In the researcher's words, Microsoft did everything properly but the logic allows abuse. Because the file creation comes from the antimalware engine's own process, its kernel drivers see it as legitimate. Disabling the mitigation removes the path but reopens CLFS memory-corruption exposure. The articles do not describe a fix.
Onde está
The articles place the flaw in clfs.sys, in how the driver creates the ".cnpf" authentication file for a log's associated container; the Defender-side trigger is the ServerMpUpdateEngineSignature call, and exposure is set by the registry value HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode.
Como foi descoberta
The researcher known as MSNightmare, Chaotic Eclipse or Nightmare Eclipse, identified by BleepingComputer and SecurityWeek as Abdelhamid Naceri, published SignDrop on GitHub on November 10, 2026, the same day as Microsoft's November updates. The release included the code and a technical write-up. The articles describe no prior report to Microsoft or coordinated disclosure. They note he has released many Windows and Defender zero-days since April, and BleepingComputer says some earlier ones were disclosed without a private report. Microsoft has not commented, and no in-the-wild exploitation has been reported.
PoC pública
A public proof of concept exists on GitHub, with C++ source, a Visual Studio project and a write-up. It spawns a SYSTEM shell by chaining the CLFS companion-file creation with Defender. The researcher suggests running it, or checking the Mode registry value, to test exposure. Cyderes compiled and tested it, and 78researchlab's Heewon Song found it works but not reliably enough for operational use. It needs Defender enabled and changes UAC prompts, which makes it noticeable. With working code public and no patch, urgency is high, though the local-only requirement makes it mainly a second-stage tool. No in-the-wild use has been reported.
Publicada em: securityaffairs.com/202968/hacking/new-signdrop-exploit-can-abuse-windows-defender-to-bypass-security-protections.html ↗
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 12:19.
Detalhes técnicos
- The bug abuses the CLFS log-file signing/authentication mechanism, which was meant to block memory-corruption attacks, and turns it into a privilege escalation path (securityonline.info). bleepingcomputer.com ties this to mitigations Microsoft implemented in October 2025. securityaffairs.com says the root cause is a design issue during the staged rollout of CLFS authentication.
- The exploit coerces Microsoft Defender into creating an authentication file with SYSTEM privileges. The file inherits attacker-controlled permissions, which yields a SYSTEM shell (gbhackers.com). securityaffairs.com describes this as tricking privileged processes like Windows Defender into opening specially crafted CLFS log files, which causes the creation of signed files with SYSTEM privileges.
- It manipulates the creation of companion ".cnpf" files (authentication files used for log file integrity verification, per securityweek.com) during privileged log access, using symbolic link path redirection, so the files are created in the security context of a privileged process such as Windows Defender. This produces SYSTEM-level writable files accessible by standard users (thehackernews.com). The root cause is how CLFS handles authentication file creation when a privileged process later accesses the log file (bleepingcomputer.com).
- It may also bypass antivirus and EDR tamper protections, because the file creation appears to come from a trusted security engine (gbhackers.com). bleepingcomputer.com likewise says it can turn the self-defense of AV/EDR engines against them, and securityaffairs.com says it effectively bypasses antivirus self-defense and tamper protections.
- Affected: Windows 11 26H2 and Windows Server 2025 builds (Experimental versions per securityweek.com and securityaffairs.com). thehackernews.com lists Windows 11 25H2, 26H1 and 26H2 plus Windows Server 2025 with CLFS authentication enabled (mode 0 or 1). About 80% of Windows installations are estimated to be exposed unless specific registry settings disable CLFS authentication enforcement (gbhackers.com, bleepingcomputer.com). securityweek.com says this particularly applies to installations older than 90 days, and securityaffairs.com says many systems remain in the 90-day learning phase with partial mitigation enabled. The 80% figure is an estimate and appears to trace back to the same underlying disclosure.
- The exploit requires Defender to be enabled. thehackernews.com found it effective in testing but not reliably operational.
- This differs from earlier Defender-related exploits, which relied on Defender file-handling race conditions; SignDrop targets the CLFS authentication mechanism instead (thehackernews.com). securityaffairs.com notes the researcher has previously released multiple impactful zero-day exploits against Microsoft Defender and other antivirus products.
- Detection hints: unexpected ".cnpf" files created by Defender, and ERROR_LOG_METADATA_CORRUPT errors (gbhackers.com).
Remediação
- No official patch exists. Apply the Microsoft fix as soon as one ships, and watch for official Microsoft advisories (thehackernews.com).
- Check the CLFS Authentication registry setting to assess exposure (thehackernews.com, bleepingcomputer.com). The researcher published a PoC for detection (bleepingcomputer.com).
- Enforce least privilege to limit the initial foothold needed (gbhackers.com).
- Monitor for the ".cnpf" file creations by Defender and the ERROR_LOG_METADATA_CORRUPT errors described above (gbhackers.com).
- Do not disable the existing CLFS mitigations. The alternative mitigations expose devices to other memory-corruption exploits (gbhackers.com, bleepingcomputer.com, securityaffairs.com).
- Previous CLFS flaws and mitigations can guide detection until an official fix is available (gbhackers.com).
Relatos divergentes
- Affected systems: securityonline.info (2026-11-11) lists Windows 11 26H2 and "experimental Windows Server builds". gbhackers.com (2026-11-12) names Windows 11 26H2 and Windows Server 2025. bleepingcomputer.com (2026-11-12), securityweek.com and securityaffairs.com (both 2026-11-13) say Windows 11 26H2 and Windows Server 2025 Experimental editions/builds. thehackernews.com (2026-11-12, the most specific) lists Windows 11 25H2, 26H1, 26H2 and Windows Server 2025 with CLFS authentication enabled (mode 0 or 1).
- Mechanism: securityonline.info describes abuse of the log-file signing mechanism in general terms. gbhackers.com describes Defender being coerced into creating a SYSTEM-owned authentication file. thehackernews.com adds symbolic link redirection of .cnpf file creation. securityaffairs.com frames it as a staged-rollout design issue. These descriptions are not necessarily contradictory.
- Researcher identity: gbhackers.com and thehackernews.com name MSNightmare; securityaffairs.com names Chaotic Eclipse; bleepingcomputer.com names Abdelhamid Naceri; securityweek.com (2026-11-13) names Abdelhamid Naceri, known as Nightmare Eclipse. They likely refer to the same person, but the links among the MSNightmare, Chaotic Eclipse and Nightmare Eclipse handles are not explicitly confirmed by any one source.
- Microsoft stance: bleepingcomputer.com says Microsoft has warned against malicious exploitation in general but has not addressed this issue; securityweek.com says Microsoft was contacted and has not yet issued a statement; other sources say Microsoft has made no public comment.
- Reliability: thehackernews.com reports the exploit as effective but not reliably operational in testing, while other sources describe it simply as working.
Linha do tempo
-
SignDrop Windows Zero-Day Exploit Abuses Defender to Bypass Security Protections and Escalate Privileges
ler a análise desta fonte ocultar
A Windows local privilege escalation zero-day vulnerability called SignDrop has been disclosed by researcher Chaotic Eclipse. The flaw targets the Common Log File System (CLFS) mitigation Microsoft implemented to prevent memory corruption bugs, exploiting a design issue during the staged rollout of CLFS authentication. By tricking privileged processes like Windows Defender into opening specially crafted CLFS log files, attackers can cause the creation of signed files with SYSTEM privileges, effectively bypassing antivirus self-defense and tamper protections. Approximately 80% of Windows systems are estimated vulnerable as many remain in the 90-day learning phase with partial mitigation enabled. No patch is currently available, and disabling the mitigation reintroduces exposure to memory corruption vulnerabilities. The exploit has been tested on Windows 11 26H2 and Windows Server 2025 Experimental builds. The researcher has previously publicly released multiple impactful zero-day exploits against Microsoft Defender and other antivirus products.
-
Nightmare Eclipse releases SignDrop, a Windows local privilege escalation zero-day exploit
ler a análise desta fonte ocultar
Security researcher Abdelhamid Naceri, known as Nightmare Eclipse, has released a zero-day exploit named SignDrop targeting a local privilege escalation vulnerability in Windows. The exploit abuses flawed logic in the Windows Common Log File System (CLFS) to elevate privileges to System by manipulating the creation of authentication files (
.cnpf) used for log file integrity verification. Tested successfully on Windows 11 26H2 and Windows Server 2025 Experimental versions, SignDrop is believed to affect approximately 80% of Windows installations worldwide, particularly those older than 90 days. There is currently no evidence of exploitation in the wild. Microsoft has been contacted for comment but has not yet issued a statement. -
New SignDrop exploit abuses Windows CLFS driver to escalate local user privileges to SYSTEM
ler a análise desta fonte ocultar
A newly released proof-of-concept exploit named SignDrop leverages a logic flaw in the Windows Common Log File System (CLFS) driver's log authentication feature to escalate a local user to SYSTEM privileges. The exploit manipulates the creation of companion .cnpf files during privileged log access by using symbolic link path redirection, causing files to be created in the security context of a privileged process such as Windows Defender. This creates SYSTEM-level writable files accessible by standard users, enabling privilege escalation. Despite the release of public exploit code and a detailed writeup by researcher MSNightmare, Microsoft has not confirmed the vulnerability, assigned a CVE, or issued a patch as of November 2026 updates. The exploit targets Windows 11 versions 25H2, 26H1, 26H2, and Windows Server 2025 with CLFS authentication enabled (mode 0 or 1). Testing showed the exploit as effective but not reliably operational, and it requires Defender to be enabled. There have been no reported in-the-wild attacks exploiting SignDrop to date. Administrators can assess exposure via the CLFS Authentication registry setting. This vulnerability differs from previous Defender-related exploits by targeting the CLFS driver's authentication mechanism rather than Defender's file handling race conditions. Users should monitor for official advisories and patches from Microsoft.
-
SignDrop Windows zero-day allows privilege escalation to SYSTEM via CLFS authentication flaw
ler a análise desta fonte ocultar
Security researcher Abdelhamid Naceri disclosed a new Windows zero-day vulnerability named SignDrop that enables attackers to gain SYSTEM privileges by abusing mitigations Microsoft implemented in October 2025 for the Common Log File System (CLFS) driver. The vulnerability arises from how CLFS handles authentication file creation when a privileged process later accesses the log file, allowing an attacker to create a file with SYSTEM-level access. This flaw can bypass tamper protection mechanisms of antivirus and endpoint detection and response (EDR) engines, effectively turning their own self-defense against them. The exploit has been tested successfully on Windows 11 26H2 and Windows Server 2025 Experimental editions, with an estimated 80% of Windows installations vulnerable. Currently, there is no patch, and the only mitigation alternatives expose devices to other risks from memory corruption exploits. The researcher published a proof-of-concept (PoC) for detection and recommends checking the relevant registry key to assess vulnerability. Naceri has a history of disclosing Windows zero-days, some of which Microsoft has patched, though others remain unpatched. Microsoft has warned against malicious exploitation but has not yet addressed this particular issue.
-
New Windows SignDrop Zero-Day Elevates Local Users to SYSTEM via CLFS Driver
ler a análise desta fonte ocultar
A new unpatched local privilege escalation zero-day vulnerability called SignDrop has been disclosed by researcher MSNightmare (aka Chaotic Eclipse). The exploit abuses the Common Log File System (CLFS) driver (clfs.sys) on Windows to escalate an attacker from standard user to NT AUTHORITY\SYSTEM by manipulating authentication files created by CLFS logs. The exploit coerces Microsoft Defender to create an authentication file with SYSTEM privileges, inheriting attacker-controlled permissions, enabling a SYSTEM shell. It also potentially bypasses antivirus and EDR tamper protections by masquerading file creation as a trusted security engine’s action. The vulnerability affects Windows 11 26H2 and Windows Server 2025 builds, with an estimated 80% of Windows installations exposed unless specific registry settings disable CLFS authentication enforcement. As this is a local exploit, initial code execution is required, making it suitable as a second-stage privilege escalation after phishing or malware. No CVE or patch has been released yet, and Microsoft has not confirmed the issue or reported in-the-wild exploitation. Defenders are advised to enforce least privilege, monitor unexpected ".cnpf" file creations by Defender, watch for ERROR_LOG_METADATA_CORRUPT errors, and avoid disabling existing CLFS mitigations to prevent re-exposure to other bugs. Previous CLFS flaws and mitigations offer detection guidance until an official fix is available.
-
SignDrop Windows CLFS zero-day allows privilege escalation, exploit public
ler a análise desta fonte ocultar
A researcher known as MSNightmare disclosed a zero-day vulnerability in Windows CLFS that enables a standard user to gain SYSTEM privileges. This flaw exploits the log-file signing mechanism, which was intended to prevent memory corruption attacks, but is abused to turn the feature into a local privilege escalation path. The proof-of-concept exploit is now publicly available on GitHub, demonstrating how to spawn a SYSTEM shell on Windows 11 26H2 and experimental Windows Server builds. No patch has been issued yet, and no attacks are reported in the wild. Microsoft has not publicly commented.