Microsoft told SecurityWeek it is 'actively investigating the reported vulnerability and will take the necessary steps to update impacted products as soon as possible,' adding that Microsoft Defender detects and blocks exploitation and alerts on the associated privilege-escalation behavior.

No CVE, advisory, or patch appeared in the November security updates, and The Hacker News notes the CISA Known Exploited Vulnerabilities catalog does not list the flaw.

The disclosure moved from claim to verified fact this week.

According to The Hacker News, Sungyup Nam, head of research at Korean security firm 78researchlab, reported that researcher Heewon Song of the firm's PurpleHound offensive team tested the exploit and found that it works — though Song assessed it does not run reliably enough for operational use.

Separately, SecurityWeek reports that cybersecurity services provider Cyderes successfully compiled and tested the proof-of-concept and found no evidence it has been used in the wild. Two independent confirmations turn a GitHub writeup into a tested attack path.

The published chain has quirks that limit its stealth.

Per The Hacker News, Defender must be enabled for it to succeed, and running the exploit changes every UAC prompt to open both a standard user shell and a SYSTEM shell, blocking other actions and making the attack noticeable to anyone at the machine.

The repository also claims the technique could work against any antimalware engine whose process runs elevated — a broader claim The Hacker News reports has not been tested.

Security Affairs adds the researcher's argument that arbitrary file creation inside an AV's own process could defeat tamper protection across products.

Administrators can check exposure at HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication, where a Mode value of 0 or 1 falls within the exploit's claimed scope and 2 or 3 means the mitigation is disabled, The Hacker News explains.

Disabling is a trap: it removes the SignDrop path but lets CLFS parse tampered log files, reopening the memory corruption flaws the authentication feature was built to stop.

The researcher estimates — per Security Affairs — that roughly 80% of Windows installations are vulnerable, since systems older than 90 days move automatically from learning mode into enforcement.

The vendor's security update guide is the place to watch for a response, The Hacker News writes, since Microsoft has confirmed only that it is investigating.

The researcher's history adds urgency: three of his earlier Defender flaws have been exploited in attacks, with RoguePlanet patched as CVE-2026-50656 and ShieldBreak as CVE-2026-69414, though SignDrop is a different class of issue, targeting the CLFS driver's own authentication logic rather than Defender race conditions.

Security Affairs also reports the researcher revealed himself as Abdelhamid Naceri, a former Microsoft employee, intensifying the responsible-disclosure debate around the release.