A researcher has published exploit code for a Windows flaw that Microsoft has not yet fixed. Called SignDrop, it does not let anyone break into a computer remotely. It can, however, turn limited access into full control of the machine, which deserves particular attention while no fix is available.
Status as of November 13, 2026. Microsoft has published no fix, no CVE identifier and no statement about SignDrop. No attacks using this flaw have been reported in the sources reviewed. This article will be updated when Microsoft responds.
What happened?
On November 10, 2026, the day of Microsoft’s monthly updates, researcher Abdelhamid Naceri, known as Nightmare Eclipse, published a proof of concept called SignDrop on GitHub. According to him, it lets an ordinary user obtain SYSTEM rights, the highest level on a Windows computer. BleepingComputer.
The researcher says he tested it on Windows 11 26H2 and on experimental builds of Windows Server 2025. Microsoft has not yet confirmed which versions are affected. SecurityWeek.
Security firm Cyderes successfully compiled and tested the code and found no evidence of real-world exploitation. A team at 78researchlab also confirmed that it works, but judged it not reliable enough for operational use. SecurityWeek, The Hacker News. The flaw is not listed in the U.S. Cybersecurity and Infrastructure Security Agency (CISA) catalog of exploited vulnerabilities.
How does the flaw work?
SignDrop abuses a protection Microsoft added in October 2025 to CLFS, the Windows component that manages certain system logs. This protection authenticates log files to prevent tampering. It comes with Windows 11 25H2 and Windows Server 2025 updates released since October 28, 2025; a learning period of about 90 days normally precedes strict enforcement. Microsoft.
The flaw lies in how Windows creates an auxiliary file associated with a log. The published code gets a privileged process, in this case Microsoft Defender, to create that file with SYSTEM rights, which opens the way to a takeover. The researcher claims other antivirus products could be used the same way, but this has not been tested. The Hacker News.
Are your systems concerned?
Microsoft has not yet published an official list. Until then, the versions to watch first are those where the abused protection is present: Windows 11 25H2 and later, and Windows Server 2025, updated since late October 2025. The researcher’s tests cover Windows 11 26H2 and experimental builds of Windows Server 2025.
Ask your IT lead to inventory the computers and servers running these versions. They will be the first to update when the fix is released. Detailed technical checks belong in an administration guide, not an improvised test.
What it allows, and what it does not
This is a local privilege escalation. An attacker must first run code on the computer with an ordinary account, for example after someone opens a malicious attachment or through a stolen password. On its own, SignDrop does not let anyone break into a network from the internet.
This type of flaw is still serious. Once SYSTEM rights are obtained, an attacker can disable protections, install persistent malware or try to reach other machines. It is often an intermediate step in ransomware attacks.
What to do
What not to do
Do not disable Microsoft Defender. The published code uses it, but removing your antivirus would expose your computers to far more common threats.
Do not disable CLFS authentication. Microsoft explicitly advises against it. This protection was added to block older flaws in the same component; removing it would reopen those risks. Microsoft.
Do not run the demonstration code on your machines. The researcher suggests using it to check whether a device is vulnerable. Unverified code has no place on a production computer or server.
What to do
Reduce initial access. Since an attacker must first run code, the usual protections keep their full value: multifactor authentication, email filtering, caution with attachments and control over which applications may run.
Limit server sign-ins. Reserve local sessions and remote desktop access for people who actually need them, especially on shared servers.
Monitor your computers. A well-configured endpoint detection and response (EDR) solution can spot abnormal behavior, such as a privileged process creating unexpected files.
Apply the fix as soon as it is released. Follow Microsoft’s announcements and plan to deploy the update quickly to the affected computers and servers.
Review your fleet’s security with Nuagerie
Our team can help you put these measures in place, monitor your computers and deploy fixes as soon as they are available. Discover our managed IT services and our cybersecurity and backup services.
For an existing service, find our contact details on the support page. To review your environment, let’s discuss your needs.
