What happened. Security researcher Abdelhamid Naceri, who goes by Nightmare Eclipse, published proof-of-concept code this week for a Windows privilege-escalation bug he calls SignDrop. A privilege-escalation bug lets someone who already has a normal account on a machine promote themselves to SYSTEM, which can do anything on that computer. Microsoft has not confirmed the flaw, assigned a CVE or shipped a fix, and it was not in the November Patch Tuesday updates.
How it works, in plain words. CLFS (Common Log File System) is a Windows kernel driver that reads log files. Attackers abused it for years with booby-trapped logs, so on Oct 28, 2025 Microsoft added "logfile authentication": the driver signs each log and writes a companion .cnpf file next to it. Naceri says that companion file is the weak spot. A normal user sets up a log, then tricks a privileged process into opening it. In his published code that process is the Microsoft Defender antimalware service, triggered through its update interface. Windows then creates the .cnpf file as SYSTEM, but with the normal user's write permissions, and symbolic-link redirection lets the attacker choose where it lands. He chains that into a SYSTEM shell.
Who is exposed. Naceri tested it on Windows 11 26H2, a 26H2 Experimental build and Windows Server 2025 Experimental, and he estimates 80% of Windows installs are vulnerable; that figure is his claim, not an independent count. Machines are in scope when the registry value HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode is 0 (enforced) or 1 (learning). The Hacker News notes installs older than about 90 days usually move to enforced mode on their own, so established machines are the ones it targets.
Limits. This is local only: an attacker needs to be running code on the machine first, for example via phishing or a stolen login. Defender must be on for the published chain, and the exploit hijacks UAC prompts in a way someone at the keyboard would notice. CISA has not added it to its Known Exploited Vulnerabilities list, and no in-the-wild attacks have been reported.
Do now. Do not turn the CLFS protection off (Mode 2 or 3): both Naceri and Microsoft's documentation warn that reopens the older memory-corruption attacks. Instead, assume any foothold can become SYSTEM. Hunt for standard-user processes creating .blf or .cnpf files in odd paths, new object-manager symbolic links, and unexpected Defender engine-update calls from non-admin sessions, and watch for Microsoft's out-of-band advisory.