Researcher discloses Windows CLFS zero-day that grants SYSTEM privileges

Overview

Updated Yesterday

On November 10, a researcher publishing as Nightmare Eclipse released SignDrop, a working exploit that lets an ordinary Windows user gain full System rights. The flaw lives in the Common Log File System (CLFS), a logging service built into Windows. It abuses a security check Microsoft added to that driver in October 2025.

The exploit needs a specific setup: a Windows 11 26H2 or Server 2025 build whose CLFS authentication setting is in learning or enforcement mode. No patch, CVE identifier, or advisory appeared in Microsoft's November updates, which shipped the same day.

Why it matters

A standard user account can become SYSTEM on affected machines, and the same chain is claimed to disable antivirus self-protection.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

CLFS flaws in CISA's exploited-vulnerabilities catalog

The logging driver has been a frequent target for privilege escalation.

80%

Windows installations estimated vulnerable

An estimate from the researcher, reported by BleepingComputer, covering affected builds.

Windows builds where the exploit was tested

Windows 11 26H2, a 26H2 experimental build, and Windows Server 2025 experimental.

Days before learning mode moves to enforcement

Established installs automatically shift into the mode the exploit targets.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

Nightmare Eclipse (also MSNightmare)

Pseudonymous security researcher

Publishing exploits; in a public dispute with Microsoft

Will Dormann

Independent security researcher

Reproduced the exploit on some builds

Heewon Song

Researcher, PurpleHound offensive content team

Tested the exploit

Organizations Involved

Microsoft

Technology company

Investigating; no patch or CVE issued

Microsoft builds Windows and its Defender antimalware engine, both of which the exploit chain relies on.

78researchlab

Security research firm

Independently tested SignDrop

A Korean security firm whose offensive team assessed the exploit's reliability.

Timeline

October 2025 November 2026

6 events Latest: Yesterday

Tap a bar to jump to that date

November 2026
Microsoft says it is investigating
Latest Statement

The company reports no evidence of exploitation and says Defender blocks attempted exploitation.
Yesterday
Independent test confirms it works
Assessment

78researchlab reports the exploit functions but is too unreliable for operational use.
2 days ago
SignDrop exploit published
Disclosure

The researcher releases a CLFS privilege-escalation chain using Windows Defender to create a file as SYSTEM.
4 days ago
August 2026
ShieldBreak bypass released
Disclosure

A Defender bypass that evaded the RoguePlanet patch, later tracked as CVE-2026-69414.
August 2026
May 2026
Researcher discloses GreenPlasma
Disclosure

A local privilege-escalation flaw, later tracked as CVE-2026-45586.
May 2026
October 2025
Microsoft adds CLFS log-file authentication
Security update

Updates to Windows 11 25H2, 26H1, and Server 2025 add a hash-based check so the driver parses only logs it wrote.
October 2025

Scenarios

Microsoft patches SignDrop and assigns a CVE

Likely Resolves by End of 2026

Discussed by: The Hacker News and Ars Technica both note the absence of a fix as the key open question

The most common path for a confirmed Windows privilege-escalation flaw is a fix in a monthly update with a CVE identifier. Because the exploit requires an established 26H2 build, Microsoft could scope a patch to affected builds. The next monthly update window is the earliest realistic timing.

Microsoft disputes exploitability and declines to patch

Possible Resolves by Jan 31, 2027

Discussed by: Independent testers who found the requirements narrow and reliability poor

Microsoft could argue the exploit depends on a specific build and configuration and does not warrant a patch. Dormann found only one of his many machines qualified, and 78researchlab judged it unreliable for real attacks. That reading would push the issue toward documentation rather than a fix.

Attackers exploit SignDrop in the wild and CISA adds it to KEV

Unlikely Resolves by Feb 28, 2027

Discussed by: Security press tracking the driver's history of active exploitation

CLFS flaws have drawn ransomware use before, and ten sit in CISA's known-exploited catalog. If a working, reliable variant appears, the agency could add SignDrop to that list, which compels US federal agencies to patch. The exploit's current unreliability makes this less likely near-term.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

April 2025

CLFS flaws used in ransomware (2025)

A CLFS vulnerability was exploited in ransomware campaigns. Ten CLFS flaws now appear in CISA's catalog of vulnerabilities known to have been exploited in attacks.

Then

Attackers used the driver to escalate privileges on compromised machines.

Now

The pattern pushed Microsoft to add authentication to CLFS log files in October 2025.

Why this matters now

SignDrop targets the very authentication feature built to stop this class of attack, turning the defense into the entry point.

May-June 2026