A public exploit called SignDrop claims to turn an ordinary Windows user account into SYSTEM, the highest control level on Windows. The proof of concept was posted on GitHub on 10 November 2026 by researcher MSNightmare, also known as Nightmare Eclipse.

The flaw is said to live in clfs.sys, the kernel driver for the Windows Common Log File System (CLFS). It targets Microsoft's CLFS log-file authentication: a hash-based code stored in a .cnpf file beside each log, letting the kernel reject tampered logs. SignDrop reportedly abuses how that file is created, using symbolic links and timing tricks to push a high-privilege Defender process into creating files in a protected place.

What is not confirmed

SignDrop has no CVE number and no patch as of 11 November, and Microsoft has not confirmed the claims. No independent test or use in real attacks has been reported. The researcher estimates about 80 percent of Windows installations are at risk, but that is an unverified estimate, not a measured count. Testing was reported on Windows 11 26H2 and Windows Server 2025.

What administrators should do

SignDrop is a local privilege escalation flaw, so an attacker must already run code on the machine as a standard user; it cannot break in from the internet alone. The CLFS authentication feature reached Windows 11 25H2 and Windows Server 2025 in updates from 28 October 2025, with new systems in learning mode for 90 days before enforcement begins. Administrators should not switch CLFS authentication off to dodge this bug: doing so would re-expose machines to older CLFS attacks the feature was built to stop, including CVE-2025-29824, used with PipeMagic malware to deploy ransomware. Instead, limit who can run code on important machines and watch for odd file creation by high-privilege processes. A second report confirms the same facts.