New Windows SignDrop zero‑day gives hackers SYSTEM privileges

# New Windows SignDrop zero‑day gives hackers SYSTEM privileges

https://gcdradar.vercel.app/incidents/new-windows-signdrop-zero-day-gives-hackers-system-privilege · AIR-2026-1932 · live

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Critical zero‑day vulnerability allowing SYSTEM privilege escalation, no known exploitation
- Fix status: No patch yet
- First reported: 2026-11-12
- AI role: No AI role
- Products: Windows
- CVSS: 9.8

## Summary

A new Windows zero‑day, named SignDrop, was disclosed that allows attackers to obtain SYSTEM privileges through a signature‑validation flaw. The vulnerability is unpatched and rated critical.

## What to do

Monitor for signs of SignDrop exploitation and apply mitigations.

## Latest updates

- 2026-11-13: Technical details reveal the exploit abuses CLFS and Windows Defender to trigger arbitrary file creation. (https://securityweek.com/nightmare-eclipse-drops-windows-zero-day-exploit-signdrop)
- 2026-11-12: Public exploit code released for SignDrop zero‑day, confirming active exploitation. (https://thehackernews.com/2026/11/new-signdrop-zero-day-exploit-turns.html)
- 2026-11-12: New Windows SignDrop zero-day gives hackers SYSTEM privileges (https://bleepingcomputer.com/news/security/new-windows-signdrop-zero-day-gives-hackers-system-privileges)

## Sources

- 2026-11-12 BleepingComputer: New Windows SignDrop zero-day gives hackers SYSTEM privileges https://bleepingcomputer.com/news/security/new-windows-signdrop-zero-day-gives-hackers-system-privileges
- 2026-11-12 The Hacker News: New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access https://thehackernews.com/2026/11/new-signdrop-zero-day-exploit-turns.html
- 2026-11-13 SecurityWeek: Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’ https://securityweek.com/nightmare-eclipse-drops-windows-zero-day-exploit-signdrop

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.