New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Swati KhandelwalNov 12, 2026Vulnerability / Endpoint Security Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver. The proof of concept, called SignDrop, targets a log-authentication feature added to the driver last year. It abuses how clfs.sys creates companion files when a privileged process opens a prepared log, using path redirection to take control of the operation. Microsoft has not confirmed the claimed flaw, assigned a CVE, or released a fix. The researcher behind the exploit, who publishes under the name MSNightmare, released the code and a detailed writeup on GitHub on Tuesday, the same day the company published its November security updates. CLFS is a logging subsystem built into Windows. Its driver has been a frequent target for privilege escalation: 10 CLFS flaws appear in CISA's catalog of vulnerabilities known to have been exploited in attacks, including one used in ransomware campaigns in April 2025. To reduce that exposure, Microsoft added an authentication check to CLFS log files in updates for Windows 11 25H2, 26H1, and Windows Server 2025 shipped in October 2025. The check attaches a hash-based message authentication code, built from log data and a key unique to each machine. The driver then parses only log files it wrote. A companion .cnpf file stores recovery data beside each log and is created with the same security attributes as the original, according to the company's logfile authentication page. SignDrop targets the creation of that companion file. According to the proof-of-concept code, a standard user prepares a CLFS log and container with paths the user controls. When a privileged process later opens that log, the driver creates the .cnpf file in the privileged process's security context rather than the user's. The exploit uses object manager symbolic links to redirect that file creation to a location the attacker chooses. In the published code, the privileged process is the Defender antimalware service, triggered through its update interface. "Everything is done properly by Microsoft here but the logic allows abuse," the researcher wrote. Because the .cnpf file inherits the original log's permissions, the result is a file created as SYSTEM that the standard user can write to. The researcher says that can be chained into a SYSTEM shell. The exploit was tested on Windows 11 26H2, a Windows 11 26H2 Experimental build, and Windows Server 2025 Experimental, according to the repository. Systems are affected when the CLFS authentication registry mode is set to 0 (enforced) or 1 (learning). Systems older than 90 days typically move from learning to enforcement automatically, so the default configuration on established installations is the one the exploit targets. A registry value of 2 or 3 means the mitigation is disabled. That takes the system outside the claimed attack surface, but the researcher and the driver's own documentation both warn against it: disabling lets CLFS parse tampered log files, reopening the memory corruption flaws the protection was built to prevent. Sungyup Nam, head of research at Korean security firm 78researchlab, reported in a published assessment today that researcher Heewon Song of the firm's PurpleHound offensive content team tested the exploit and found that it works. Song assessed that it does not run reliably enough for operational use, Nam wrote. Defender must be enabled for the published chain to succeed. Running the exploit changes every UAC prompt to open a standard user shell and a SYSTEM shell, blocking other actions and making the attack noticeable to anyone at the machine. The repository claims the technique can work against any antimalware engine whose process runs with elevated privileges. That broader claim has not been tested. No CVE, advisory, or patch for SignDrop appeared in the November security updates. The CISA Known Exploited Vulnerabilities catalog does not list it, and no attacks using the exploit have been reported. Administrators can check their exposure by reading the CLFS authentication mode at HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication, where a Mode value of 0 or 1 falls within the researcher's claimed scope. The vendor's mitigation guidance describes the setting and the risks of disabling it. The researcher has released a series of exploits targeting Windows and Defender since April. The vendor confirmed an earlier Defender exploit called RoguePlanet in June as CVE-2026-50656 and patched it the following month. The ShieldBreak bypass followed in August and was assigned CVE-2026-69414. Three of the researcher's earlier Defender flaws have been exploited in attacks. SignDrop is a different class of issue. Where the earlier exploits targeted race conditions in Defender's file handling, this one targets the CLFS driver's own authentication feature. The vendor's security update guide is the place to watch for a response. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. endpoint security, Vulnerability, Windows Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction The Flood is Coming And The Pipes Were Already Full Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Attend Live Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk