A security researcher has published a working exploit called SignDrop that lets someone already logged in to a Windows PC or server raise their access to SYSTEM, the highest level on the machine. BleepingComputer reported it on November 12, 2026, and Ars Technica covered it a day later. As of November 14, Microsoft hasn’t published an advisory or a fix, and neither outlet reported attacks in the wild.

What’s new

  • The flaw sits in the Windows Common Log File System (CLFS) driver, inside a protection Microsoft added in October 2025 to block older CLFS attacks, according to researcher Abdelhamid Naceri, who released the exploit.
  • It is a privilege escalation bug. An attacker needs a foothold first, such as a phished employee login or malware already on the machine.
  • Naceri told BleepingComputer the technique can get around antivirus and EDR tamper protection, so an intruder could switch security tools off.
  • He tested it on Windows 11 26H2 and Windows Server 2025 builds. His estimate that most Windows installs are exposed hasn’t been independently checked.
  • There is no CVE number yet, and the November Patch Tuesday updates don’t fix it.

Who it affects

Businesses running Windows 11 laptops and Windows Server, especially where several people share a machine or where a standard account could be stolen through phishing. According to BleepingComputer, a machine is exposed when the registry value HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode is 0 or 1.

Naceri advises against turning the CLFS protection off, because that reopens the older memory bugs it was built to stop. For now there is no clean switch to flip.

Our take

Don’t run the public exploit on your own computers to test them. Reading the registry value tells you the same thing without running someone else’s code. This week, put your effort where the attack starts: multi-factor sign-in on every account, phishing filters on email, and no shared admin logins. Then make sure the person who manages your PCs is watching for Microsoft’s fix and pushes it the day it lands, and that alerts about security tools being disabled go to a real inbox.

If nobody owns Windows patching in your business, our IT consulting team can set that up. Our brief on this month’s Outlook zero-day covers the fixes Microsoft did ship in November.