Researcher posts unconfirmed Windows SignDrop CLFS privilege PoC
Original title: Windows SignDrop 0-Day Exploit Lets Attackers Gain SYSTEM Privileges Through CLFS Protection
The GitHub proof of concept claims local user-to-SYSTEM escalation, with no CVE or Microsoft confirmation.
A researcher known as MSNightmare published a GitHub proof of concept called SignDrop on November 10, 2026. It claims a flaw in clfs.sys can turn a normal user into SYSTEM by abusing CLFS authentication-file creation. The report says there is no CVE, no Microsoft advisory, no independent verification, and no evidence of real attacks. Microsoft had not confirmed the claims as of November 11, 2026.
Unconfirmed: Microsoft has not confirmed SignDrop, and no independent test or in-the-wild use is reported.
- The researcher says testing used Windows 11 26H2 and Windows Server 2025.
- The claimed bug is local and cannot be reached from the internet alone.
- An estimated 80 percent exposure figure is described as an estimate, not a count.
- Disabling CLFS authentication is not advised because it restores older parsing risk.
Impact: local escalation from a normal user to SYSTEM
| Product | Affected |
|---|---|
| Microsoft Windows | Windows 11 26H2 and Windows Server 2025 in researcher tests |
- 1.Do not disable CLFS authentication.
- 2.Limit who can run code on important machines.
- 3.Watch for unexpected CLFS errors such as ERROR_LOG_METADATA_CORRUPT.
From the original article
3 min read at cybersecuritynews.com
A public exploit called SignDrop targets a Windows security feature meant to stop attacks on the Common Log File System (CLFS). It claims to turn a normal user account into a SYSTEM account, the highest level of control on Windows. The flaw has no CVE number and no patch as of November 11, 2026.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.