SignDrop: unpatched Windows 0-day reportedly hands out System rights

This story rests on a single source, an Ars Technica article published on November 13, 2026, so take it with the matching pinch of salt. According to the outlet, a researcher going by the handle Nightmare Eclipse disclosed a vulnerability dubbed SignDrop on Tuesday, proof of concept included. The same researcher has reportedly dropped numerous other Windows 0-days in recent months.

What the exploit does

The flaw is said to live in the Common Log File System (CLFS), Windows’ general-purpose logging service, used in both user mode and kernel mode. The idea: trick a privileged process into opening a CLFS container specially crafted by an ordinary user.

The privileged process in question would be Windows Defender, which is a bit like getting the bouncer to hold the door for you. The exploit reportedly calls a legitimate antivirus function, ServerMpUpdateEngineSignature, designed to handle signature updates. By manipulating symbolic links in the Windows object manager, the attacker gets the container opened in the security context of the antimalware engine. If the associated authentication file is missing, CLFS creates it with Defender’s System privileges, while applying the access control list of the original file. The attacker would therefore end up in control of a file created with System rights, which is the starting point for the privilege escalation.

According to Ars Technica, the vulnerability stems from a security measure Microsoft introduced in October 2025, precisely to stop other CLFS flaws from being exploited. The researcher also claims the technique could be used to disable any antivirus or EDR, since the file creation appears to come from their own process.

Who is exposed

The attack is local: it assumes the attacker already has a user account on the machine. Nightmare Eclipse says the exploit works on Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental.

Researcher Will Dormann told Ars Technica he had reproduced the exploit, which reportedly works as described, but not on every version of Windows 11. According to him, you need a 26H2 system that has existed for more than 90 days: a fresh install brought up to date would not do. Of the many machines he uses, exactly one ticked all the boxes.

Microsoft is rolling out 26H2 in waves, which makes the number of affected machines hard to estimate.

What you can check while waiting for Microsoft

The source mentions neither a patch nor an official workaround. It does, however, give you two things to check:

• the winver command tells you whether your system is on 26H2;
• the value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode: set to 0 or 1, the system would be vulnerable, according to Will Dormann.

In a statement sent to Ars Technica after publication, Microsoft says it is reviewing the researcher’s analysis and has no evidence of active exploitation. The company adds that Defender blocks potential exploitation attempts.

Which leaves one observation: a protection added to close CLFS holes appears to have dug a fresh one. The patch is now waiting for a patch of its own.