Unpatched Windows ‘SignDrop’ Exploit Grants System Rights

A researcher has released SignDrop, an unpatched Windows exploit that can give an ordinary local user full System privileges on vulnerable machines by making Microsoft Defender perform a privileged file operation.

The researcher, known as Nightmare Eclipse, published the code and technical write-up under the GitHub handle MSNightmare on Nov. 10. Cybersecurity firm Cyderes’ Howler Cell team said it compiled and ran the proof of concept from a standard-user session and obtained a System-privileged console.

Separately, vulnerability researcher Will Dormann told Ars Technica that he reproduced the exploit, but only one of his many machines met the necessary configuration. The finding confirms a working attack without establishing that all Windows systems are exposed.

SignDrop requires an attacker to already be able to run code locally as an ordinary user. It is a way to deepen an existing intrusion, not a standalone method for breaking into a PC remotely.

A Windows Defense Becomes the Attack Path

The flaw targets the Common Log File System, or CLFS, a Windows logging component. Microsoft introduced authentication hardening in updates released on or after Oct. 28, 2025, to check log-file integrity before processing their contents.

According to the researcher’s write-up, SignDrop tricks Defender into opening a prepared log file. CLFS then creates an associated authentication file using Defender’s System privileges but preserves permissions that let the attacker access it. Cyderes said the exploit replaces the generated content with a malicious software library that is subsequently loaded by a privileged Windows process, producing the System console.

Nightmare Eclipse reported testing the exploit on Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental. Those are reported test targets, not a comprehensive affected-product list. Dormann cautioned that simply installing updates on a fresh 26H2 system was not enough to make the exploit work.

A key prerequisite is active CLFS authentication. Microsoft’s documentation says the Mode value under HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication is 0 for enforcement and 1 for learning mode. Cyderes recommends prioritizing machines with those settings, while warning that the registry value alone does not establish that exploitation will succeed.

Microsoft documents a 90-day learning period before automatic enforcement. That is a transition between authentication modes, not evidence that every Windows installation older than 90 days is vulnerable.

What Defenders Can Do Now

The researcher’s write-up and Cyderes’ analysis describe SignDrop as unpatched. Cyderes’ Nov. 12 report listed no assigned CVE, Microsoft advisory or public vendor comment. Ars Technica reported on Nov. 13 that Microsoft had not responded to its request for comment.

Disabling CLFS authentication is not a safe fix, Cyderes warned, because it removes protection against older attacks. Microsoft’s existing documentation also says it does not recommend disabling the hardening; that guidance predates SignDrop and is not a SignDrop-specific workaround.

Cyderes recommends inventorying CLFS settings, restricting untrusted local code execution and retaining file-creation, library-loading and process telemetry. In its test, the exploit removed the planted library after use, so a later disk inspection could miss that evidence. The firm said it had identified no confirmed exploitation in the wild as of Nov. 10.

The release follows Nightmare Eclipse’s public dispute with Microsoft over vulnerability disclosure. Alongside an earlier exploit in April, the researcher wrote: “I was not bluffing Microsoft and I’m doing it again.” The SignDrop write-up gives no separate explanation for bypassing coordinated disclosure.

Microsoft said in May that uncoordinated releases of exploit code for unpatched flaws put customers at risk, and that it continued to welcome vulnerability submissions regardless of past interactions.