Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’
Source SecurityWeek
Rated High by Threat Radar's AI analysis
Data as of 13 Nov 2026, 08:58 UTC
What to do
AI-suggested
Users should monitor for updates from Microsoft. Since the exploit requires local access, restricting untrusted local user access and applying principle of least privilege may reduce risk. Check the vendor advisory for current remediation guidance once available.
Description
SignDrop is a Windows zero-day local privilege escalation exploit that abuses a vulnerability in the Common Log File System (CLFS) and Windows Defender. It allows a standard user to coerce Windows Defender to create a signature file with SYSTEM privileges at an attacker-controlled location, enabling privilege escalation to SYSTEM. The exploit has been tested on Windows 11 26H2 and Windows Server 2025 Experimental builds and is believed to affect approximately 80% of Windows installations older than 90 days. There is no evidence of in-the-wild exploitation at this time.