SignDrop, a Windows privilege-escalation zero-day with public exploit code, has no fix. The Hacker News reports that Microsoft has not confirmed the flaw, assigned a CVE, or released a patch. The code was published on Tuesday, 10 November 2026, the same day Microsoft shipped its November security updates. If you installed those updates expecting to be covered, you aren't. They contain no CVE, advisory or patch for SignDrop, according to The Hacker News.
This is a local flaw, not a remote one. An attacker needs a foothold on the machine first, such as a standard user account or malware already running. SignDrop then turns that foothold into SYSTEM, the highest privilege level on Windows.
How SignDrop abuses CLFS log authentication
The exploit targets the Common Log File System (CLFS) driver, clfs.sys. In October 2025 Microsoft added an authentication check to CLFS log files in updates for Windows 11 25H2, 26H1 and Windows Server 2025. After that change the driver parses only log files it wrote itself, per The Hacker News. The check was meant to block attacks on CLFS driver bugs.
SignDrop goes after the companion file that this authentication system creates. The researcher's own summary: "Everything is done properly by Microsoft here but the logic allows abuse."
In other words, a security feature became the attack surface.
Which Windows versions are affected
The researcher's GitHub repo says the exploit was tested on Windows 11 26H2, a Windows 11 26H2 Experimental build, and Windows Server 2025 Experimental, according to The Cyber Express.
ThreatDefence's analysis puts the CLFS authentication feature on Windows 11 25H2 and 26H1 and Windows Server 2025. It dates the rollout to 28 October 2025 (KB5056852), after which devices went through a 90-day learning period before enforcing. ThreatDefence also notes that Windows 10, Windows 11 24H2 and earlier, and Server 2022 and earlier are not on Microsoft's list for the feature. Because SignDrop attacks that feature, older systems may fall outside its reach, but none of the reports linked here state that outright, and Microsoft has said nothing.
What is confirmed and what is only claimed
Confirmed across several outlets:
- Working exploit code and a writeup are public on GitHub.
- There is no CVE, advisory or patch, including in the November updates.
- It is a local privilege escalation to SYSTEM via clfs.sys.
Claimed by the researcher, not independently verified:
- That SignDrop can bypass antivirus and EDR tamper protection.
- That no effective workaround exists.
On attacks in the wild, ThreatDefence's FAQ says Microsoft and CISA have reported none. That is a security vendor's summary, not an official statement.
Who released it
The Hacker News and The Cyber Express credit a researcher publishing as MSNightmare.
What to do until Microsoft responds
With no patch and no official mitigation, the practical defences are basic ones:
- Limit who can log on locally. SignDrop needs an existing foothold, so fewer local accounts and tighter access reduce your exposure.
- Don't run untrusted code. A local exploit has to get onto the machine somehow. Turning on file extensions helps you spot a fake .pdf.exe before you open it.
- Keep installing updates anyway. November's patches don't fix SignDrop, but they fix other things.
The thing to watch is Microsoft's Security Update Guide. The Hacker News points to it as the place to watch for Microsoft's response to SignDrop.
