News Security news
SignDrop: public exploit for an unpatched Windows CLFS driver flaw grants SYSTEM privileges
On 12 November 2026 researcher Abdelhamid Naceri (Nightmare Eclipse) published a proof-of-concept exploit called SignDrop on GitHub. It abuses a flaw in the Common Log File System driver (clfs.sys) – specifically in the protection Microsoft added to CLFS because of earlier attacks. According to the author, a standard user or malware on the machine can gain SYSTEM privileges. There is no fix, no CVE and no statement from Microsoft yet. Here is what it means for Windows admins.
Key points
- Who is affected: admins of Windows 11 25H2 and later and Windows Server 2025 machines with CLFS logfile authentication enabled. This is local privilege escalation – the attacker must already be able to run code on the machine.
- According to the author, the bug lies in how clfs.sys creates the companion .cnpf authentication file. Microsoft introduced it to block tampered CLFS log files, which attackers have repeatedly abused in the past.
- The Mode value under HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication tells you whether a machine is exposed: 0 or 1 means the mitigation is on – and, per the author, the system is vulnerable.
- Microsoft has not shipped a fix. Disabling the mitigation (value 2) would stop SignDrop but reopen the door to older CLFS bugs – both the author and Microsoft advise against it.
What happened
Researcher Abdelhamid Naceri, who goes by Nightmare Eclipse, published a project called SignDrop on GitHub on 12 November 2026 – a write-up and proof-of-concept exploit for a still-unpatched flaw in the Windows Common Log File System driver (clfs.sys). According to the author, it lets a standard user gain SYSTEM privileges.
The README does not say Microsoft was told in advance. There is no fix or CVE, and as of 12 Nov we found no advisory. Nobody has reported attacks so far – but the exploit is public, so it is only a matter of time before attackers pick it up.
What CLFS is and where the bug lies
CLFS is the Windows subsystem for transactional logging, used by system services and applications alike. Attackers have repeatedly exploited bugs in its driver for privilege escalation, often in ransomware intrusions. Microsoft responded with CLFS logfile authentication: the driver stores authentication codes (HMACs) and a companion .cnpf file alongside each log file and refuses to open tampered ones. The mitigation is on by default in Windows 11 25H2.
According to the author, SignDrop abuses the way the driver creates that .cnpf file when a new log is set up. When a highly privileged process later opens the file, the attacker ends up with SYSTEM privileges. The author also claims the same approach can defeat antivirus and EDR tamper protection – we have not verified that. We are not repeating the details of the technique.
Who is affected
- Systems with CLFS authentication enabled – registry key
HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication, valueMode:0= mitigation enforced,1= learning mode → vulnerable according to the author,2= disabled by an administrator,3= disabled by the system → SignDrop does not work, but there is no protection against older bugs.
- The author confirmed the exploit on Windows 11 26H2 and on Experimental builds of Windows 11 26H2 and Windows Server 2025. His estimate that 80% of Windows installations are vulnerable is not backed by data.
Check the value in PowerShell:
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\CLFS\Authentication" -Name ModeWhat to do
- Do not disable the mitigation. Microsoft warns that without it CLFS parses malicious log files too.
- Limit code execution: standard user accounts, and application control (WDAC/AppLocker) on servers and shared machines.
- Watch for signs of escalation (our advice): new SYSTEM processes launched from user directories, unexpected
.blfand.cnpffiles in user and temp folders, EDR alerts about attempts to disable protection. - Follow Microsoft: deploy the fix as soon as it ships. The 10 November updates (see our November 2026 Patch Tuesday roundup) do not address SignDrop – the exploit came out after them – but install them anyway for the exploited Outlook flaw. Pull out any indicators Microsoft or security vendors publish with our IOC extractor.
Updates
- 12 Nov 2026 – first version of this article.
FAQ
Is SignDrop dangerous for home users?
On its own it cannot get into a computer – the attacker needs code already running, typically from a malicious attachment or download. SignDrop then helps them take full control and switch off protection. The best defence is care with attachments and downloads, and day-to-day use of a standard account without admin rights.
Should we disable the CLFS mitigation until a patch arrives?
We would not. Microsoft's documentation says that without the mitigation CLFS parses potentially corrupted or malicious log files – and bugs in exactly that parsing have been exploited by ransomware gangs in the past. Disabling it trades one known bug for a whole class of others.
When will a fix be available?
As of 12 Nov 2026 Microsoft had not commented and we found no advisory or CVE. The next scheduled Patch Tuesday is 8 December 2026, though Microsoft can ship an out-of-band fix. We will update this article.
Sources
Spotted a mistake? Let us know and we will correct it openly.
Related
Critical
Firefox 160 fixes 99 flaws, 57 rated high and nine sandbox escapes - update ESR too
Mozilla shipped Firefox 160 on 10 November 2026, along with Firefox ESR 153.7 and 115.45. The Firefox 160 advisory alone lists 99 vulnerabilities, 57 of them rated high. Mozilla describes nine of those as sandbox escapes, meaning flaws that can break the isolation meant to keep a malicious page away from the operating system. There are no reports of exploitation so far. Here is what to update and how to check it across a fleet.
Actively exploited
ScreenConnect attacks on managed service providers: ConnectWise disables RMM+ extensions
Late on 11 November 2026 ConnectWise said it is investigating unauthorized access to certain partner ScreenConnect environments, mostly managed service providers (MSPs). Its working theory is that attackers abused third-party extensions from the RMM+ family, which can run remote commands, and used them to push their own remote-access clients into customer networks. ConnectWise says it has found no vulnerability in ScreenConnect itself.
Actively exploited
Citrus ransomware gets in through contractor accounts and spreads Sn00py by Group Policy
On 11 November 2026 Kaspersky described Citrus, a previously undocumented Russian-speaking ransomware group. It logged in with low-privilege contractor accounts, hid its traffic in VLESS tunnels disguised as Yandex, impersonated a domain controller through an AD CS flaw patched in July and finally pushed its Go-based Sn00py encryptor to the whole domain through Group Policy.