SignDrop Windows zero-day turns Defender against itself

Using symbolic links in the Windows Object Manager, the attacker makes Defender open the container with the antimalware engine's rights. If an authentication file is missing, CLFS creates it, and it does so with Defender's System privileges. The new file inherits the access list of the original, so the attacker can get at a file created as System and use that to climb the privilege ladder.

The irony is that the hole comes from a protection Microsoft added in October 2025 to stop other CLFS attacks. "Everything is done properly by Microsoft here but the logic allows abuse," Nightmare Eclipse wrote. The researcher also claims the trick works against any antimalware engine, because file creation appears to come from the product's own trusted process. That could be used to switch off antivirus or EDR (endpoint detection and response) tools.

Which Windows versions are affected?

Nightmare Eclipse says the exploit worked on Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental. A system is vulnerable if its CLFS authentication mode is learning or enforcement mode.

Researcher Will Dormann reproduced the exploit and says it works as described, with a catch. It seems to need Windows 26H2 that has been installed for more than 90 days, so a fresh install with updates won't do. The registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode has to be 0 or 1. Of the many machines Dormann uses, only one qualified.

Microsoft rolls out versions like 26H2 in stages, so it's unclear how many people run it. You can check your version by running "winver". Microsoft says it is investigating, has no evidence of attacks in the wild, and that Defender blocks potential exploitation attempts. Nightmare Eclipse has published numerous other Windows zero-days in recent months.