CVE-2023-36424

What it actually does

CVE-2023-36424 is a local elevation-of-privilege vulnerability in the Windows Common Log File System driver, clfs.sys. An attacker who already has the ability to run code as a low-privileged local user can trigger improper kernel-mode behavior in CLFS and gain SYSTEM-level privileges. Successful exploitation can allow full control over the affected Windows host, including disabling security tools, dumping credentials, modifying protected files, installing services, and executing arbitrary code with kernel-adjacent administrative authority. The vulnerability is listed in CISA KEV and has active in-the-wild exploitation, so it should be treated as a proven exploitation risk rather than a theoretical issue.

Why it matters to the business

Compromise of this vulnerability can turn a limited foothold on a workstation or server into full host takeover. In business terms, an attacker who first gains basic user access through phishing, malware, stolen credentials, or another vulnerability can use this flaw to become an administrator, steal sensitive data, move laterally, deploy persistence, and disrupt operations. Because it affects many supported and legacy Windows client and server versions and is in the Known Exploited Vulnerabilities catalog with a remediation due date of 2026-04-27, unpatched systems represent a regulatory and operational exposure. Although it is not currently marked as ransomware-associated in KEV, privilege escalation flaws in Windows are commonly chained with ransomware and hands-on-keyboard intrusions.

How an attack unfolds

An attacker must first obtain local code execution on an affected Windows system, typically through malware delivery, phishing, remote access tooling, exploitation of a separate remote vulnerability, or abuse of valid credentials. From that initial low-privileged context, the attacker runs exploit code that interacts with the Windows Common Log File System driver. The exploit manipulates CLFS-related kernel operations to trigger the vulnerability and elevate the attacker's token or execute privileged operations as NT AUTHORITY\SYSTEM. Once elevated, the attacker can create local administrator accounts, install or modify services, disable endpoint protections, access credential material, dump LSASS memory, alter logs, deploy persistence, and use the compromised host as a platform for lateral movement. Active exploitation has been observed in the wild, making patch verification and post-exploitation hunting important even where no obvious remote attack surface exists.

How to fix it

Apply the Microsoft security updates that address CVE-2023-36424 for all affected Windows versions. Because no exact fixed build list was provided, use the November 2023 Microsoft security update baseline or any later cumulative update for supported Windows releases. Prioritize Windows servers, domain-joined workstations, systems used by administrators, remote-access hosts, VDI images, golden images, and internet-adjacent systems where attackers are likely to land. Retire or isolate unsupported Windows versions that cannot receive security updates. Where immediate patching is not possible, reduce risk by limiting local logon rights, removing unnecessary administrator privileges, enforcing application control, enabling tamper protection, monitoring for local privilege escalation behavior, and segmenting high-value systems. Mitigations should be considered temporary because this is a kernel-level local privilege escalation flaw with known exploitation.

How to confirm the fix worked

Confirm that each affected system has installed a Microsoft cumulative update that includes the November 2023 security fixes or a later superseding update. Validate the installed Windows build and update level using enterprise patch management, Windows Update history, PowerShell inventory, vulnerability scanners, or configuration management tools. Check the file version and signing metadata for C:\Windows\System32\drivers\clfs.sys and compare it against the expected version for the installed operating system build after the relevant Microsoft update. Run authenticated vulnerability scans to confirm CVE-2023-36424 is no longer reported. For systems that were offline, cloned from old images, or restored from backup, re-check patch status after they rejoin the network. Confirm that compensating controls such as endpoint detection, application control, and least-privilege policies remain active, but do not rely on those controls as proof of remediation.

Typical attack path

1. Gain initial access to a Windows workstation or server using phishing, malware, stolen credentials, exposed remote access, or another vulnerability.
2. Execute code as a standard or otherwise low-privileged local user on the affected system.
3. Run a local exploit that targets the Windows Common Log File System driver, clfs.sys.
4. Trigger the vulnerable kernel-mode code path through crafted CLFS interactions or log-file-related operations.
5. Obtain SYSTEM-level privileges or equivalent local administrative control.
6. Disable or tamper with security controls, create persistence, access credentials, or modify protected system areas.
7. Use the elevated access to move laterally, exfiltrate data, deploy additional malware, or stage broader operational impact.

How to detect it

Detection should focus on evidence of local privilege escalation and follow-on activity, because exploitation is local and may not produce a unique network signature. Collect and review endpoint detection telemetry, Windows Security logs, Sysmon logs, PowerShell logs, service control manager events, scheduled task logs, application control logs, crash dumps, and Windows Error Reporting artifacts. Look for a low-privileged process that rapidly transitions to spawning SYSTEM-level processes, especially cmd.exe, powershell.exe, pwsh.exe, rundll32.exe, regsvr32.exe, wscript.exe, cscript.exe, mshta.exe, schtasks.exe, sc.exe, net.exe, or credential access tools. Investigate new service creation, new scheduled tasks, new local administrators, LSASS access, Defender or EDR tampering, firewall rule changes, and unusual files created in user-writable directories shortly before privileged activity. Review events around CLFS-related activity, including crashes or errors involving clfs.sys and unusual access to .blf or .regtrans-ms files. Because the provided threat-actor context does not identify a named actor and no ransomware association is listed, do not rely on actor-specific indicators; prioritize behavioral hunting for local privilege escalation and post-exploitation tradecraft. Useful log sources include Windows Security Event IDs 4624, 4672, 4688, 4697, 4720, 4728, 4732, 7045 via System logs, PowerShell 4103/4104, Sysmon Event IDs 1, 7, 10, 11, 12, 13, and 22, Microsoft Defender alerts, EDR process lineage, and vulnerability/patch inventory data.

• C:\Windows\System32\drivers\clfs.sys
• clfs.sys
• \Device\Clfs
• C:\Windows\System32\config\TxR
• .blf
• .regtrans-ms
• Common Log File System
• Event ID 7045
• A service was installed in the system
• Event ID 4672
• Special privileges assigned to new logon
• Event ID 4688
• Event ID 4697
• Event ID 4720
• Event ID 4728
• Event ID 4732
• Event ID 4104
• Invoke-Mimikatz
• sekurlsa::logonpasswords
• procdump.exe -ma lsass.exe
• comsvcs.dll, MiniDump
• sc.exe create
• schtasks.exe /create
• net localgroup administrators
• powershell.exe -enc
• powershell.exe -EncodedCommand
• cmd.exe /c whoami /priv
• NT AUTHORITY\SYSTEM

What your security team should do

• Patch all affected Windows clients and servers with the relevant Microsoft cumulative update or later superseding update, prioritizing systems with user logons, administrative use, remote access, and high business criticality.
• Treat unpatched systems as high-risk because this vulnerability is in CISA KEV and has active in-the-wild exploitation; track remediation against the 2026-04-27 KEV deadline at minimum, but remediate substantially sooner where possible.
• Hunt for post-exploitation behavior, especially low-privileged processes that suddenly spawn SYSTEM-level shells, service creation, scheduled tasks, credential dumping, security tool tampering, or new local administrators.
• Review endpoint telemetry for suspicious interaction with CLFS artifacts, unexpected .blf or .regtrans-ms file activity, and abnormal crashes or errors involving clfs.sys.
• Restrict local administrator rights and interactive logon permissions to reduce the number of accounts that can convert initial access into full host control.
• Use application control or endpoint policy to block execution from user-writable directories such as Downloads, Temp, AppData, and public profile paths, where local exploit tools are commonly staged.
• Ensure EDR tamper protection, LSASS protection, credential guard where supported, and centralized logging are enabled on high-value Windows systems.
• Rebuild or deeply investigate unpatched systems where there are signs of privilege escalation followed by credential access, security control tampering, or lateral movement.