Computer Repair · November 15, 2026 · ComputerKing Team

Windows Has an Unpatched Zero-Day Called SignDrop: A Normal Account Can Become SYSTEM, and Defender Is the Only Defence for Now

On 10 November, a security researcher published a Windows zero-day called SignDrop. The flaw sits in CLFS, a built-in Windows logging component, and can let an ordinary user account become SYSTEM — the highest privilege on the machine. As of writing, Microsoft has not released a patch, saying only that it is investigating closely. Microsoft also says Defender detects and blocks attacks using this flaw, and that it has not seen anyone using it in the real world. This guide covers which PCs may be affected, how to check your defences, and what not to do before a patch arrives. Pricing is quoted case by case.

Key points

On 10 November 2026, security researcher Abdelhamid Naceri published a Windows zero-day called SignDrop on GitHub. The flaw sits in the Common Log File System (CLFS) — a built-in Windows logging component — and an attacker can use it to raise an ordinary user account to SYSTEM, the highest privilege on a Windows machine. As of writing, Microsoft has not released a patch, saying only that it is investigating closely. Microsoft also says Defender detects and blocks attacks using this flaw, and that it has not seen anyone using it in the real world. This guide covers which PCs may be affected, how to check your defences, and what not to do before a patch arrives.

1. What happened: what SignDrop is

• Published: 10 November 2026, the same day as Microsoft's November Patch Tuesday. The researcher published working attack code on GitHub.
• Where the flaw is: CLFS (Common Log File System), a built-in Windows logging system used by many programs and system functions.
• What it does: an ordinary user account can become SYSTEM. SYSTEM is the highest-level account in Windows and can do almost anything, including installing software, changing system settings and reading other users' data.
• No patch yet: Microsoft says it is investigating closely and has not released a fix. The flaw is not in CISA's Known Exploited Vulnerabilities catalogue.
• No real-world attacks seen: Microsoft says Defender detects and blocks attacks using this flaw, and it has not seen anyone using it in the real world.

2. What CLFS is, and why a logging feature can be this dangerous

• CLFS is a system logging feature: programs use it to record what has happened, like a notebook. Because system functions use it constantly, it runs with high privilege inside the system.
• The problem is a privilege mismatch: a logging feature should only write things down, but the flaw lets an attacker reach a higher privilege through it than they should ever hold.
• Microsoft added a defence in October 2025: CLFS log file authentication, designed to stop exactly this kind of attack. This flaw shows that defence is not airtight.
• That does not mean logging itself is bad: CLFS is a normal system feature. It cannot and should not be switched off. The right approach is to wait for Microsoft's patch while making sure the existing defences are on.

3. Which PCs may be affected

• Versions the researcher tested: Windows 11 26H2, a 26H2 experimental build, and a Windows Server 2025 experimental build.
• Another researcher, Will Dormann, reproduced the attack, but only on 26H2 PCs that had been running for more than 90 days — in other words, machines that have been running the newer CLFS code for a while.
• Microsoft has not published its own list of affected versions, so the range above is what researchers have tested, not an official verdict. Do not assume you are definitely safe, and do not assume you are definitely affected.
• How to check your version: press Win + R, type winver, press Enter. If you are on 26H2, pay particular attention to the next two sections.

4. Before a patch exists, what protects you

• Keep Defender on, and keep it updated: Microsoft says Defender detects and blocks attacks using this flaw. It is the only defence Microsoft has confirmed as working for now. Do not switch it off to save resources or to make the PC feel faster.
• Do not use an administrator account for everyday work: SignDrop raises an ordinary account to SYSTEM. If you already work as an administrator every day, an attacker does not even need that step. Use a standard account day to day, and switch to an administrator only when needed.
• Do not run programs from unknown sources: privilege-escalation flaws like this usually need another way in first, such as a malicious program. Not opening suspicious attachments and not installing software from unknown sources cuts off that way in.
• Keep installing updates: the November Patch Tuesday itself carries other fixes. Do not skip the whole update just because SignDrop has no patch yet.

5. The 30-second check: are your defences on

1. Version: press Win + R, type winver, and check whether you are on 26H2. If you are, watch for Microsoft's patch news.

2. Defender: open Windows Security and check that virus and threat protection is on and the definitions are up to date.

3. Updates: go to Settings, then Windows Update, and check whether any updates are waiting.

4. Account: go to Settings, then Accounts, and check whether the account you use every day is a standard user or an administrator.

6. Do not do these things

• Do not switch off Defender or disable real-time protection: before a patch exists, Defender is the only confirmed working defence.
• Do not download a so-called SignDrop fix tool from an unfamiliar website: Microsoft has not released a patch, so any third-party tool claiming to fix it cannot be trusted, and is very likely malware.
• Do not follow online instructions to change CLFS settings: CLFS is a core system feature. Changing it wrong can make the system unstable, or stop it booting at all.
• Do not install several antivirus programs out of fear: two real-time protections running together slow each other down and can conflict. One Defender, switched on and up to date, is enough.

7. When to bring it in

• You are not sure whether Defender is working properly, or you suspect it was switched off at some point.
• The PC is a work machine, with accounts and updates managed by policy that you cannot change yourself.
• You suspect you clicked a suspicious program or attachment and want the PC checked for anything unusual.
• In these cases, bringing the PC in for a check is safer than trying things one by one on your own.