SignDrop: unpatched Windows CLFS zero-day gives local users SYSTEM, public exploit available, no CVE or patch

Linha do tempo

1. thehackernews.com ↗ · pub. 12/11/2026 14:50 · coletado 12/11 16:00

   New SignDrop exploit abuses Windows CLFS driver to escalate local user privileges to SYSTEM

   ler a análise desta fonte ocultar

   A newly released proof-of-concept exploit named SignDrop leverages a logic flaw in the Windows Common Log File System (CLFS) driver's log authentication feature to escalate a local user to SYSTEM privileges. The exploit manipulates the creation of companion .cnpf files during privileged log access by using symbolic link path redirection, causing files to be created in the security context of a privileged process such as Windows Defender. This creates SYSTEM-level writable files accessible by standard users, enabling privilege escalation. Despite the release of public exploit code and a detailed writeup by researcher MSNightmare, Microsoft has not confirmed the vulnerability, assigned a CVE, or issued a patch as of November 2026 updates. The exploit targets Windows 11 versions 25H2, 26H1, 26H2, and Windows Server 2025 with CLFS authentication enabled (mode 0 or 1). Testing showed the exploit as effective but not reliably operational, and it requires Defender to be enabled. There have been no reported in-the-wild attacks exploiting SignDrop to date. Administrators can assess exposure via the CLFS Authentication registry setting. This vulnerability differs from previous Defender-related exploits by targeting the CLFS driver's authentication mechanism rather than Defender's file handling race conditions. Users should monitor for official advisories and patches from Microsoft.

2. bleepingcomputer.com ↗ · pub. 12/11/2026 13:04 · coletado 12/11 15:00

   SignDrop Windows zero-day allows privilege escalation to SYSTEM via CLFS authentication flaw

   ler a análise desta fonte ocultar

   Security researcher Abdelhamid Naceri disclosed a new Windows zero-day vulnerability named SignDrop that enables attackers to gain SYSTEM privileges by abusing mitigations Microsoft implemented in October 2025 for the Common Log File System (CLFS) driver. The vulnerability arises from how CLFS handles authentication file creation when a privileged process later accesses the log file, allowing an attacker to create a file with SYSTEM-level access. This flaw can bypass tamper protection mechanisms of antivirus and endpoint detection and response (EDR) engines, effectively turning their own self-defense against them. The exploit has been tested successfully on Windows 11 26H2 and Windows Server 2025 Experimental editions, with an estimated 80% of Windows installations vulnerable. Currently, there is no patch, and the only mitigation alternatives expose devices to other risks from memory corruption exploits. The researcher published a proof-of-concept (PoC) for detection and recommends checking the relevant registry key to assess vulnerability. Naceri has a history of disclosing Windows zero-days, some of which Microsoft has patched, though others remain unpatched. Microsoft has warned against malicious exploitation but has not yet addressed this particular issue.

3. gbhackers.com ↗ · pub. 12/11/2026 03:41 · coletado 12/11 05:00

   New Windows SignDrop Zero-Day Elevates Local Users to SYSTEM via CLFS Driver

   ler a análise desta fonte ocultar

   A new unpatched local privilege escalation zero-day vulnerability called SignDrop has been disclosed by researcher MSNightmare (aka Chaotic Eclipse). The exploit abuses the Common Log File System (CLFS) driver (clfs.sys) on Windows to escalate an attacker from standard user to NT AUTHORITY\SYSTEM by manipulating authentication files created by CLFS logs. The exploit coerces Microsoft Defender to create an authentication file with SYSTEM privileges, inheriting attacker-controlled permissions, enabling a SYSTEM shell. It also potentially bypasses antivirus and EDR tamper protections by masquerading file creation as a trusted security engine’s action. The vulnerability affects Windows 11 26H2 and Windows Server 2025 builds, with an estimated 80% of Windows installations exposed unless specific registry settings disable CLFS authentication enforcement. As this is a local exploit, initial code execution is required, making it suitable as a second-stage privilege escalation after phishing or malware. No CVE or patch has been released yet, and Microsoft has not confirmed the issue or reported in-the-wild exploitation. Defenders are advised to enforce least privilege, monitor unexpected ".cnpf" file creations by Defender, watch for ERROR_LOG_METADATA_CORRUPT errors, and avoid disabling existing CLFS mitigations to prevent re-exposure to other bugs. Previous CLFS flaws and mitigations offer detection guidance until an official fix is available.

4. securityonline.info ↗ · pub. 11/11/2026 03:32 · coletado 11/11 04:00 primeiro registro

   SignDrop Windows CLFS zero-day allows privilege escalation, exploit public

   ler a análise desta fonte ocultar

   A researcher known as MSNightmare disclosed a zero-day vulnerability in Windows CLFS that enables a standard user to gain SYSTEM privileges. This flaw exploits the log-file signing mechanism, which was intended to prevent memory corruption attacks, but is abused to turn the feature into a local privilege escalation path. The proof-of-concept exploit is now publicly available on GitHub, demonstrating how to spawn a SYSTEM shell on Windows 11 26H2 and experimental Windows Server builds. No patch has been issued yet, and no attacks are reported in the wild. Microsoft has not publicly commented.