Windows SignDrop Flaw Gives Hackers Full System Access

A researcher using the pseudonym Nightmare Eclipse published a new Windows zero-day on Tuesday, giving anyone with a standard local account a path to full System rights on certain Windows machines, according to Ars Technica. The flaw, nicknamed SignDrop, is the latest in a string of public disclosures from a researcher who has an ongoing, very public dispute with Microsoft, Ars Technica reported.

For most home users, the bug does not open a door from the internet directly into a computer. It is a local privilege-escalation flaw, meaning an attacker already needs some kind of foothold — malware already running, a shared office machine, or a malicious insider — before SignDrop becomes useful. Once that foothold exists, though, the exploit can turn an ordinary user account into a System-level account, the highest level of access on a Windows machine, Ars Technica reported.

What is the SignDrop vulnerability?

SignDrop lives inside the Common Log File System, a Windows component Microsoft describes as "a general-purpose logging service used by software clients running in user-mode or kernel-mode," according to Microsoft documentation cited by Ars Technica. The vulnerability lets an attacker with regular user rights trick a privileged process — in this case, Windows Defender — into creating a file with System-level permissions that the attacker can then take over.

How does the exploit work?

The attack chain is technical but the mechanics matter for anyone running an affected system. A standard user creates a log file using CLFS, then calls a legitimate Windows Defender function named ServerMpUpdateEngineSignature, which Defender normally uses to process antivirus signature updates, Ars Technica reported. By manipulating Windows Object Manager symbolic links, the attacker forces Defender to open the user's log file while running with its own elevated System privileges. If an authentication file tied to that log is missing, CLFS creates one — using Defender's System-level access. Because CLFS copies the original file's permissions onto the new one, the attacker ends up controlling a file that was created with System rights.

Nightmare Eclipse wrote that the underlying flaw is ironic, because the vulnerable mechanism was a security fix Microsoft added in October 2025 specifically to stop attackers from exploiting earlier CLFS bugs, according to Ars Technica.

"If everything is chained correctly, funnily this legit security mitigation can be used against itself and allow an elevation [of] privileges. Everything is done properly by Microsoft here but the logic allows abuse," Nightmare Eclipse wrote, as quoted by Ars Technica.

The researcher added that the same technique can be aimed at other antivirus and endpoint-detection tools, not just Defender, because it tricks those programs' own kernel drivers into trusting a file-creation request that appears to come from their own legitimate process, Ars Technica reported.

Which versions of Windows are affected?

Nightmare Eclipse said the proof-of-concept worked against Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental, according to Ars Technica. Windows 11 26H2 is a released, publicly distributed version, which widens the pool of machines that could be affected beyond test builds alone.

Is a patch available?

Ars Technica's report does not describe a Microsoft patch for SignDrop. Nightmare Eclipse has published multiple other Windows zero-days in recent months, and security researcher Will Dormann told Ars Technica he has tracked the pattern. Microsoft has not issued a statement addressed in the Ars Technica report confirming a fix timeline.

What should Windows administrators do now?

Ars Technica reported that people can check their own exposure by looking at the CLFS authentication mode setting on their machines. If that mode is set to "learning" or "enforcement," the system is vulnerable, and the proof-of-concept code that accompanied the disclosure is designed to spawn a SYSTEM-level command shell on susceptible machines, according to the report.

What to watch

• Whether Microsoft issues a patch or mitigation guidance for CLFS-related privilege escalation in an upcoming security update.
• Whether security vendors beyond Windows Defender confirm their own antimalware engines can be targeted by the same technique, as Nightmare Eclipse claimed.
• Whether Nightmare Eclipse discloses additional unpatched Windows flaws, continuing the pattern Will Dormann described to Ars Technica.
• Whether enterprise IT teams managing Windows 11 26H2 and Windows Server 2025 systems audit CLFS authentication mode settings in the meantime.

For now, the disclosure leaves system administrators managing Windows 11 26H2 and Windows Server 2025 machines to assess their own exposure using the authentication mode check described above, with no confirmed Microsoft fix yet reported.