---
title: SignDrop: public Windows CLFS zero-day PoC turns the CLFS log-authentication mitigation into a SYSTEM shell; no CVE or patch yet | ctxsec
url: https://ctxsec.com/items/signdrop-windows-clfs-authentication-0day-lpe-public-poc-no-cve-nov-10
description: "The researcher MSNightmare released SignDrop, a local privilege escalation in clfs.sys on Nov 10, Patch Tuesday. The flaw is in how the driver creates the .cnpf authentication file that the CLFS log-authentication mitigation (shipped October 2025) writes beside each log: a standard user prepares a log with paths they control, gets a privileged process (Defender's antimalware service, via its update interface, in the published code) to open it, and uses object-manager symlinks to make the SYSTEM-context .cnpf land where they choose, writable by them. The README says machines with CLFS Authentication Mode 0 (enforced) or 1 (learning) are affected, which covers most installs older than 90 days; it was tested on Windows 11 26H2 and Windows Server 2025 Experimental builds. The Hacker News reports 78researchlab reproduced it but found it not reliable enough for operational use. Microsoft hasn't assigned a CVE or shipped a fix, it isn't in CISA KEV, and no attacks have been reported."
status: "public PoC from the researcher (Nov 10, 2026); independently reproduced per The Hacker News; Microsoft has not confirmed it, no CVE or patch; no in-the-wild use reported"
published: 2026-11-12
---

> The researcher MSNightmare released SignDrop, a local privilege escalation in clfs.sys on Nov 10, Patch Tuesday. The flaw is in how the driver creates the .cnpf authentication file that the CLFS log-authentication mitigation (shipped October 2025) writes beside each log: a standard user prepares a log with paths they control, gets a privileged process (Defender's antimalware service, via its update interface, in the published code) to open it, and uses object-manager symlinks to make the SYSTEM-context .cnpf land where they choose, writable by them. The README says machines with CLFS Authentication Mode 0 (enforced) or 1 (learning) are affected, which covers most installs older than 90 days; it was tested on Windows 11 26H2 and Windows Server 2025 Experimental builds. The Hacker News reports 78researchlab reproduced it but found it not reliable enough for operational use. Microsoft hasn't assigned a CVE or shipped a fix, it isn't in CISA KEV, and no attacks have been reported.

[← Cybersecurity News](/news) · [markdown](/items/signdrop-windows-clfs-authentication-0day-lpe-public-poc-no-cve-nov-10.md)

public PoC from the researcher (Nov 10, 2026); independently reproduced per The Hacker News; Microsoft has not confirmed it, no CVE or patch; no in-the-wild use reported

2026-11-12 11:41 PM ET

### SignDrop: public Windows CLFS zero-day PoC turns the CLFS log-authentication mitigation into a SYSTEM shell; no CVE or patch yet

- **Exposure check:** `HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication` value `Mode`: 0 or 1 is in the claimed scope; 2 or 3 means the mitigation is off.
- **Don't** disable the mitigation to dodge this: Microsoft and the researcher both warn that reopens the older CLFS memory-corruption bugs (10 CLFS CVEs are in KEV).
- **Watch:** Microsoft's Security Update Guide for a CVE/fix. This researcher's earlier Defender bugs (RoguePlanet CVE-2026-50656, ShieldBreak CVE-2026-69414) were later patched, and three of their earlier Defender flaws were exploited in attacks.
- See the SignDrop tip for detection ideas.

Sources: [SignDrop README (MSNightmare / Project NightCrawler, released Nov 10, 2026)](https://git.projectnightcrawler.dev/NightmareEclipse/SignDrop/src/branch/main/README.md) · [The Hacker News: New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access (Nov 12, 2026)](https://thehackernews.com/2026/11/new-signdrop-zero-day-exploit-turns.html) · [Microsoft: Common Log File System (CLFS) authentication mitigation](https://support.microsoft.com/en-us/servicing/os/windows/2025/03/common-log-file-system-clfs-authentication-mitigation)