Windows 11 26H2 users with Microsoft Defender enabled are facing a new zero-day vulnerability called SignDrop — one that turns Microsoft’s own security hardening against itself. The flaw, disclosed publicly on GitHub by researcher Abdelhamid Naceri (aka Nightmare Eclipse), lets a standard user escalate to full SYSTEM privileges without admin rights or physical access.
It does not require phishing, malware download, or user interaction beyond already being logged in, just the right Windows configuration and time on the machine. And it only works because of a safeguard Microsoft shipped last year to prevent exactly this kind of attack. The irony is baked in. It’s not theoretical: Cyderes confirmed full SYSTEM shell access.
Will Dormann at CERT/CC reproduced it on at least one Windows 11 26H2 system, but only one, and only after 90 days of uptime. That narrow window matters. A fresh install? Not vulnerable.
Windows 11 25H2? Not affected. Windows Server 2025 Experimental? Yes, per Naceri’s testing, but no independent confirmation yet.
The bug lives in the Common Log File System (CLFS), a low-level Windows component used by drivers and services for logging. Last October, Microsoft added cryptographic authentication to CLFS log files, so tampered logs would be rejected outright. But SignDrop abuses how the system creates companion.cnpf files during that verification process.
An attacker preps a malicious log, then tricks Defender, which runs as SYSTEM, into opening it. The resulting.cnpf file inherits Defender’s top-tier permissions but retains the attacker’s control over its contents. From there, privilege escalation is near-instant. Microsoft says Defender already detects and blocks SignDrop.
It also says it has seen no evidence of real-world use. That’s cold comfort. Naceri’s prior exploits, BlueHammer among them, all ended up in active campaigns after he published PoCs. There is no patch.
Not yet. Microsoft is investigating. A fix is unlikely before December 8, Patch Tuesday, unless the company breaks its cycle. Disabling CLFS authentication is not advised: it reopens older memory-corruption flaws.
Users can check if the mitigation is active via Registry key HKEY_LOCAL_MACHINE…CLFS…Authentication…Mode, value 0 or 1 means it’s on, but doesn’t guarantee exploitability. This isn’t a Windows 11 download issue. It’s not about activating Windows 11 Pro. It’s a silent, local, post-authentication escalation, one that bypasses EDR tamper protection by masquerading as Defender itself.
And it’s live, unpatched, and public. Microsoft’s next move arrives December 8.
CDFiled by The Computing Desk
Laptops, desktops, processors, graphics cards and the operating systems that run on them.
More from this desk →
Be the first to comment
Join the argument. No password, just your email or a passkey.