SignDrop: Public Windows Exploit Claims Standard User to SYSTEM by Abusing CLFS Log Authentication — No CVE, No Patch, and Disabling the Feature Makes It Worse

High · 2026-11-13 · By H.A

A researcher has published SignDrop, an unpatched proof-of-concept that claims SYSTEM-level privilege escalation on Windows 11 and Server 2025 by abusing the CLFS authentication mitigation, with no CVE, fix or confirmed exploitation yet.

Overview

A researcher with a history of dropping Windows exploits without coordinated disclosure has published SignDrop, a proof-of-concept that claims to take a standard user to NT AUTHORITY\SYSTEM by abusing the Common Log File System (CLFS) driver, clfs.sys. The target is unusual. SignDrop goes after CLFS log-file authentication, the mitigation Microsoft added specifically to stop the long run of CLFS privilege-escalation exploits.

As of 11 November 2026 there is no CVE, no patch and no Microsoft confirmation, and no exploitation in the wild has been reported. The claims have not been independently validated.

The Vulnerability

CLFS has been one of the most abused Windows kernel components for years, a favourite of ransomware operators for local privilege escalation. In response, Microsoft added an HMAC to CLFS log files, computed from the file contents and a per-system secret key. If the code does not match, CLFS refuses to open the file. The feature reached Windows 11 25H2 and Windows Server 2025 in updates from late October 2025. New systems run a 90-day learning mode before switching to enforcement.

According to the researcher, SignDrop abuses how the driver creates the ".cnpf" authentication file when a new log is created through the exposed \\CLFS device:

• Object-manager symbolic links and file-timing tricks redirect a file operation.
• A high-privilege Microsoft Defender process is made to create files in a protected location.
• That primitive is turned into SYSTEM-level code execution.

The researcher says both learning and enforcement modes are exposed, and reports testing on Windows 11 26H2 and Windows Server 2025 lab builds. Their estimate that around 80% of Windows installations are at risk is unverified. One review reports the PoC does not work when CLFS authentication is turned off, but that is not a safe workaround (see below).

Timeline

• Late October 2025: CLFS log authentication ships for Windows 11 25H2 and Windows Server 2025.
• 10 November 2026: the SignDrop proof-of-concept is posted publicly. The researcher's previous accounts on code-hosting platforms had been suspended.
• 11 November 2026: still no CVE, advisory or patch. No reports of exploitation.

Tradecraft

SignDrop is a local privilege escalation. An attacker must already run code as a normal user, for example through phishing, a malicious download or a compromised service account. In real intrusions, LPE bugs like this are used to:

• disable or tamper with endpoint security,
• dump credentials from LSASS,
• install kernel-level persistence,
• prepare a host for ransomware deployment.

Public Windows LPE code has historically been folded into criminal toolkits within days. Some secondary reports claim SignDrop can also disable antivirus or EDR. That has not been verified.

Detection

With no patch and no signatures for a CVE, detection depends on behaviour:

• Unusual file creation by Microsoft Defender or other SYSTEM processes in protected directories, especially right after a standard-user process touched CLFS.
• Object-manager symbolic links created by unprivileged processes, and junction or symlink abuse in user-writable paths.
• Unexpected CLFS errors such as ERROR_LOG_METADATA_CORRUPT, and creation of .blf or .cnpf files by unusual processes.
• Standard-user processes spawning children running as SYSTEM. This is a classic LPE signal that most EDRs can alert on.

To see the CLFS authentication options available on a host (read-only help):

fsutil clfs authenticate /?

Read Microsoft's fsutil clfs documentation before changing anything.

Recommended Actions

• Do not disable CLFS authentication. It is on by default, and turning it off lets the driver open crafted log files again, re-exposing the system to the older CLFS memory-corruption exploits it was built to stop.
• Reduce the chance of an attacker getting a first foothold. SignDrop needs local code execution: enforce application control (WDAC/App Control or AppLocker), block macros from the internet, and keep users off local admin.
• Keep EDR tamper protection enabled and alert on attempts to stop security services.
• Prioritise the next Windows security update once Microsoft responds. Watch for an out-of-band advisory or a CVE that references CLFS authentication.
• Hunt for symlink-abuse patterns and Defender-originated file writes on high-value servers and admin workstations.

Analyst Assessment

Until Microsoft confirms or rebuts it, SignDrop sits between "credible claim" and "proven". The researcher has a track record of public Windows exploits, and the code is public, which lowers the bar for criminals. The irony is the target. The exploit goes after the hardening layer meant to end CLFS exploitation, and the instinctive workaround, disabling that layer, would make things worse. Treat this as a high-priority watch item: tighten controls against initial access and privilege escalation now, and patch quickly when a fix arrives.