Unpatched 'SignDrop' Windows CLFS Zero-Day Grants SYSTEM Privileges

Executive Summary

On November 10, 2026, a security researcher publicly released details and a proof-of-concept (PoC) exploit for a new, unpatched zero-day vulnerability in Microsoft Windows. Dubbed "SignDrop," the vulnerability exists in the Common Log File System (CLFS) driver (clfs.sys) and can be exploited for local privilege escalation (LPE). A successful exploit allows a low-privileged user to gain full NT AUTHORITY\SYSTEM privileges. The attack is particularly notable because it subverts a security mitigation that Microsoft itself had previously implemented to protect CLFS. As of November 13, 2026, the vulnerability remains unpatched and has no assigned CVE identifier.

Vulnerability Details

The SignDrop vulnerability is a logic flaw in how the CLFS driver handles file authentication. In October 2025, Microsoft introduced a mitigation to prevent CLFS log file tampering by adding authentication codes stored in a companion .cnpf file. SignDrop abuses this very mechanism.

The exploit works by creating a specially crafted CLFS log file and then tricking a privileged process, such as Microsoft Defender's MsMpEng.exe, into opening it. When the privileged process accesses the log file, the clfs.sys driver attempts to create the corresponding .cnpf authentication file. Due to the way the file path is manipulated by the attacker, the driver creates this file in a location controlled by the attacker, but does so with SYSTEM privileges. This allows the attacker to hijack the file operation and gain arbitrary code execution with the highest privileges.

• Attack Vector: Local
• Complexity: High
• Privileges Required: Low
• User Interaction: Required (An initial foothold on the system is necessary)

Affected Systems

The researcher claims the vulnerability affects a wide range of modern Windows systems where the CLFS mitigation is active. The PoC exploit has been confirmed to work on:

• Windows 11 26H2
• Windows Server 2025

The vulnerability likely affects other recent versions of Windows as well. The primary prerequisite is an attacker having the ability to execute code on the target system, even as a standard user.

Exploitation Status

A full proof-of-concept exploit for SignDrop has been publicly released on GitHub by the researcher.

This significantly increases the risk of exploitation, as threat actors can readily adapt the public code for use in their campaigns. While it has not yet been reported as exploited in the wild, its public availability makes it a prime candidate for integration into malware and post-exploitation toolkits. Local privilege escalation flaws like this are critical components of the attack chain, used by ransomware operators and APTs after gaining an initial foothold.

Cyber Observables — Hunting Hints

The following patterns may help identify exploitation attempts related to SignDrop:

Detection Methods

• Behavioral Analytics: EDR and security monitoring tools should be configured to detect suspicious process chains. For example, a non-privileged process spawning a command prompt that then attempts to manipulate CLFS files, followed by the elevation of that process to SYSTEM, is a strong indicator of LPE.
• File System Monitoring: Monitor for the creation of .cnpf files in user-writable directories like C:\Users\<user>\ or C:\Windows\Temp\. Legitimate .cnpf files should typically be created alongside their corresponding log files (.blf).
• PoC-based Detection: Since the PoC is public, security vendors will likely develop signatures based on its specific artifacts and behaviors. Ensure EDR and antivirus tools are updated to detect these.

Remediation Steps

As of November 13, 2026, there is no official patch from Microsoft for the SignDrop vulnerability.

Organizations must rely on compensating controls until a patch is released.

1. Restrict Code Execution: The primary mitigation is to prevent attackers from gaining an initial foothold. Strengthen defenses against phishing, enforce application control/allowlisting, and secure public-facing services.
2. Endpoint Detection and Response (EDR): A robust EDR solution is the best defense against unpatched LPE vulnerabilities. EDR can detect and block the malicious behaviors associated with the exploit chain, even without a specific signature for the vulnerability itself.
3. Monitor for Public PoC Artifacts: Configure threat hunting queries and alerts to look for specific file names, process interactions, or command-line arguments used in the public PoC.
4. Apply Microsoft's Patch: Once Microsoft releases a security update that addresses this vulnerability, it should be applied on an emergency basis, prioritizing workstations and critical servers.