BleepingComputer reported on 12 November 2026 that researcher Abdelhamid Naceri, also called Nightmare Eclipse, released SignDrop. It is a Windows exploit that gives SYSTEM, the top access level, to someone already on the machine. Naceri says it abuses a safeguard Microsoft added in October 2025 to the Common Log File System (CLFS).
Naceri says the safeguard writes a signature file beside each log file. A standard user sets up log files, then uses symbolic links, which are path redirects, to make Windows Defender open them. The signature file is then created as SYSTEM, with the original file's permissions. He says an antivirus driver trusts requests from its own process, so tamper protection lets this through. He claims it can turn off any antivirus or EDR tool. Naceri guesses about 80% of Windows installs are affected, because exposure depends on the CLFS mitigation state and whether the install is more than 90 days old. He tested only Windows 11 26H2, its Experimental build and Windows Server 2025 Experimental. Microsoft's response and a patch date are not known.
A control that trusts who is calling can be beaten by swapping the caller. If Naceri is right that it can disable AV and EDR, endpoint tooling stops being a backstop on an affected machine. Leaders can ask which fleets are in a vulnerable CLFS mode, shown by a registry value of 0 or 1, and what protects them if the endpoint agent can be turned off.