Security researcher Abdelhamid Naceri released a new Windows zero-day exploit named SignDrop that lets attackers gain SYSTEM privileges, BleepingComputer reported.
The exploit targets mitigations Microsoft introduced in October 2025 to defend against authentication attacks in the Common Log File System driver.
The flaw allows attackers to force privileged processes like Windows Defender to open files so the authentication file gets created with SYSTEM privileges. The Common Log File System then creates it using the original file’s access permissions, according to BleepingComputer.
“Everything is done properly by Microsoft here but the logic allows abuse,” Naceri said.
Naceri tested the exploit on Windows 11 version 26H2, Windows 11 version 26H2 Experimental, and Windows Server 2025 Experimental, estimating that 80% of Windows installations are vulnerable, BleepingComputer reported. Security researcher Will Dormann said in an interview with Ars Technica that he reproduced the exploit and confirmed it works as described, though not on all versions of Windows 11.
Bypassing Antimalware Defenses
The exploit works by triggering arbitrary file creation in the context of an antimalware process itself, Ars Technica reported. Because kernel drivers see the file creation request coming from a legitimate process, the request passes, turning off antivirus and Endpoint Detection and Response software.
Over the past several days, we have been listening to the conversation around coordinated disclosure and the relationship between security researchers and vendors. We recognize that this relationship is both critical and, at times, fragile. We deeply value the security community,…
Dormann explained that targeted systems must meet specific age requirements to be vulnerable. “The requirements are important in that it seems to require Windows 26H2, and one that has existed for more than 90 days, it seems,” Dormann told Ars Technica. “That is, you can’t just take a new 26H2 system and install updates and have it work.”
Out of numerous machines Dormann uses for testing, only a single device met this requirement, according to Ars Technica. Because Microsoft uses staged rollouts for Windows updates such as version 26H2, the exact number of affected users remains unclear.
Checking System Vulnerability
Users can check if their devices are vulnerable by running the proof-of-concept exploit supplied in the researcher’s post, which spawns a SYSTEM shell if the system is vulnerable, BleepingComputer reported. Alternatively, administrators can check the registry value at HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesCLFSAuthenticationMode.
If the registry value is set to 0 or 1, representing learning mode or enforcement mode, the computer is vulnerable, according to BleepingComputer. Naceri recommends running the proof-of-concept to check device status since no official patch currently exists from Microsoft.
Naceri noted that disabling the Common Log File System mitigation would expose devices to memory corruption attacks, leaving users with no immediate solution except waiting for a patch.
Microsoft Response and Patch Status
Microsoft representatives did not respond to an email seeking comment, Ars Technica reported. Naceri, a former Microsoft employee, has disclosed numerous zero-day flaws in Windows components since April, including BigDiskBuster, ShieldCrash, ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend, according to BleepingComputer.
While Microsoft has fixed several of those disclosed flaws—such as ShieldBreak, RoguePlanet, YellowKey, GreenPlasma, and MiniPlasma—the remaining zero-day bugs lack official patches, BleepingComputer reported.
Frequently Asked Questions
How do I check my Windows version?
Users can check their operating system build by running the winver command, according to Ars Technica. This helps determine whether a system is running Windows 11 version 26H2.
Can I disable the CLFS mitigation to stay safe?
Disabling the Common Log File System mitigation is not recommended because it would leave devices exposed to memory corruption attacks, BleepingComputer reported.
When will Microsoft release a patch?
Microsoft representatives did not respond to requests for comment regarding a timeline for an official patch, Ars Technica reported.
Related reading