A newly disclosed Windows zero-day can hand local users full System rights by abusing Defender and the log service.
The flaw was dropped by researcher Nightmare Eclipse on Tuesday, November 10, 2026 and affects Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental. The exploit forces privileged Windows Defender to open a crafted Common Log File System container, letting an ordinary user escalate to System. Nightmare Eclipse said a security measure Microsoft added in October 2025 can be used against itself, and the bug may affect other antivirus engines. Researcher Will Dormann said it reproduced but requires Windows 26H2 and a system that had existed more than 90 days, with CLFS Authentication Mode set to 0 or 1. Microsoft did not respond.