A new Windows zero-day called SignDrop can turn an ordinary user account into full SYSTEM control, and as of November 13, 2026, there is no patch for it. The catch: an attacker has to get code running on your PC first, so the best defense this week is an old one: don’t open what you don’t trust.
The exploit code went public on GitHub on November 10, 2026, the same day Microsoft shipped its monthly Patch Tuesday updates. It came from a researcher who goes by Nightmare Eclipse and has been publishing Windows exploits since April without warning Microsoft first. No CVE number has been assigned, and Microsoft has not confirmed the flaw.
A security fix turned into a side door
SignDrop targets the Common Log File System, or CLFS, a part of Windows that programs use to keep log files. Attackers have abused CLFS for years, so Microsoft added a protection that stamps each log file with an authentication code and refuses to open files that don’t match. Microsoft’s support page explains that the feature starts in a 90-day “learning mode” before it fully enforces the rule.
According to the researcher, SignDrop tricks Microsoft Defender, which runs with the highest privileges on the PC, into creating one of those authentication files in a way a regular user can then take over. He says it worked on Windows 11 version 26H2 and on test builds of Windows Server 2025. Security researcher Will Dormann told Ars Technica he reproduced it, though not on every version of Windows 11.
What actually protects you this week
SignDrop is not a remote attack. Nobody can use it alone to break into a computer over the internet. It is a second step for someone who already got a program running on your machine, through a fake download, a booby-trapped attachment or a sketchy “free” app. That narrows what you need to do:
- Skip files you weren’t expecting, even when they look like an invoice, a game mod or a shipping notice.
- Leave Windows Update on. Microsoft delivers Defender’s security intelligence updates through Windows Update, and researchers expect any SignDrop fix to arrive the same way.
- Don’t switch off the CLFS protection. It can be disabled in the registry, but security researchers warn that doing so would reopen the older CLFS attacks it was built to stop.
Microsoft had not commented publicly on SignDrop as of November 13. Until it does, the exploit stays a threat that depends on one thing it can’t do by itself: get you to run it.
Before you double-click anything this weekend, ask yourself whether you were actually expecting that file.
