Disgruntled researcher Nightmare Eclipse released a zero-day exploit that grants SYSTEM rights on specific Windows versions. This vulnerability allows attackers to bypass any antimalware engine or EDR by triggering arbitrary file creation within the context of the antimalware process itself. Because the request comes from a legitimate process, kernel drivers pass the action. I find the ability to turn off any antivirus via this method completely unacceptable.
Vulnerable systems and requirements
The exploit works against Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental. Users can check their status by running the "winver" command to see if they have 26H2. A system is vulnerable if the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode value is 0 or 1. If the CLFS authentication mode sits in "learning mode" or "enforcement mode", the provided PoC should spawn a SYSTEM shell.
Researcher Will Dormann reproduced the exploit, though he noted it does not work on all Windows 11 versions. He identified a significant limitation regarding how long the system must exist.
"The requirements are important in that it seems to require Windows 26H2, and one that has existed for more than 90 days, it seems," Dormann explained.
| Target Version | Condition |
|---|---|
| Windows 11 26H2 | CLFS mode is 0 or 1 |
| Windows Server 2025 Experimental | Must exist > 90 days |
Microsoft response
Microsoft stated it is investigating the writeup and found no evidence the vulnerability is being exploited in the wild. The company also claims Defender blocks potential exploitation attempts. Only one of the many machines Dormann uses met the specific requirements for the exploit.
