CVE-2026-32078

What it actually does

CVE-2026-32078 is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Projected File System component. An attacker who already has local, low-privileged code execution can trigger unsafe memory reuse in the affected file system functionality and potentially execute code with elevated privileges, commonly SYSTEM-level privileges. The CVSS vector indicates local access is required, exploitation complexity is low, no user interaction is required, and successful exploitation can fully compromise confidentiality, integrity, and availability of the affected Windows host.

Why it matters to the business

If exploited, this vulnerability can allow an attacker who has already gained a foothold on a Windows workstation or server to take full control of that system. This can enable credential theft, disabling of security tools, lateral movement, persistence, data tampering, or deployment of additional malware. The issue affects multiple supported Windows desktop and server versions, including Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Although EPSS is currently low, there is no known public exploit maturity, and it is not listed in CISA KEV, local privilege escalation vulnerabilities are commonly chained with phishing, browser, VPN, or application compromises to complete an intrusion.

How an attack unfolds

An attacker first obtains the ability to run code locally as a standard user, such as through stolen credentials, malware execution, exploitation of another application, or interactive access. The attacker then invokes vulnerable Windows Projected File System behavior in a way that causes the affected component to reference memory after it has been freed. By carefully shaping memory state around that condition, the attacker may be able to corrupt kernel or privileged process memory and redirect execution or modify security-sensitive structures. If successful, the attacker escalates from a low-privileged account to a highly privileged context, typically allowing them to run commands as SYSTEM, access protected files, dump credentials, install persistence, or disable defenses. There is currently no indication in the provided data of active exploitation, ransomware use, named threat actor activity, or public exploit maturity.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-32078 for each affected Windows version as soon as it is available through Windows Update, Microsoft Update Catalog, WSUS, Microsoft Configuration Manager, or the organization’s endpoint management platform. Prioritize internet-facing Windows servers, shared workstations, developer systems, administrator workstations, VDI images, and systems where low-privileged users can execute code. Because no exact fixed build numbers or KB identifiers were provided, validate remediation against Microsoft’s official Security Update Guide for the affected Windows release and patch level. If immediate patching is not possible, reduce exposure by limiting local logon rights, enforcing least privilege, restricting untrusted code execution through application control, monitoring use of vulnerable file system features, and hardening endpoint detection and response controls. Mitigations should be treated as temporary because local privilege escalation flaws are best addressed by applying the vendor fix.

How to confirm the fix worked

Confirm affected Windows systems have received the applicable Microsoft security update for CVE-2026-32078 or are running a Windows build that includes the fix. Use centralized patch compliance tooling, Windows Update history, Microsoft Defender Vulnerability Management, WSUS, Microsoft Configuration Manager, Intune, or equivalent asset management platforms to verify update status across Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems. On individual hosts, review installed hotfixes and OS build information using supported administrative tools such as Windows Update history, Get-HotFix, systeminfo, or winver, then compare results to Microsoft’s official fixed build guidance. Validate that the ProjFS-related system components, including the Windows Projected File System filter driver, have been updated as part of the OS security update. Also confirm no temporary mitigation, such as application control or logon restriction, is being counted as permanent remediation unless patching is not yet possible.

Typical attack path

1. Gain local authenticated access to an affected Windows workstation or server using credentials, malware, remote access, or exploitation of a separate vulnerability.
2. Execute code as a low-privileged local user on the target system.
3. Trigger the vulnerable Windows Projected File System use-after-free condition through local file system interactions.
4. Manipulate memory state so the freed object is reused in an attacker-influenced way.
5. Achieve elevated code execution or privilege modification on the local host.
6. Use elevated privileges to dump credentials, install persistence, disable security controls, access sensitive data, or move laterally.

How to detect it

Because this is a local memory-corruption privilege escalation vulnerability, there may be no CVE-specific network indicator or reliable single log event proving exploitation. Detection should focus on post-exploitation behavior consistent with a low-privileged process suddenly gaining elevated privileges. Review endpoint detection telemetry, Windows Security logs, Sysmon logs, PowerShell logs, process creation logs, EDR timeline data, and driver or service activity around suspicious privilege transitions. Look for unexpected processes running as SYSTEM that originated from user-writable directories, temporary directories, browser download locations, archive extraction paths, or scripting engines. Investigate suspicious use of credential access tools, LSASS access, security product tampering, creation of new local administrators, service creation, scheduled task creation, driver loading, and abnormal access to Projected File System components. Relevant Windows events include process creation events, logon events, special privilege assignment, service installation, scheduled task registration, local group membership changes, and audit policy or security-control changes. Since no named threat actors, ransomware campaigns, or public exploit artifacts were provided, detection should be behavior-based rather than IOC-only.

• PrjFlt.sys
• Projected File System
• ProjFS
• Event ID 4688
• Event ID 4624
• Event ID 4672
• Event ID 7045
• Event ID 4698
• Event ID 4732
• Event ID 1102
• Event ID 4719
• Sysmon Event ID 1
• Sysmon Event ID 7
• Sysmon Event ID 10
• Sysmon Event ID 11
• cmd.exe /c whoami /priv
• whoami /groups
• net localgroup administrators
• net localgroup administrators /add
• powershell.exe -nop
• powershell.exe -ExecutionPolicy Bypass
• reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• schtasks /create
• sc.exe create
• rundll32.exe
• %TEMP%\
• %APPDATA%\
• %LOCALAPPDATA%\Temp\

What your security team should do

• Prioritize patch deployment to affected Windows servers and endpoints where users, service accounts, developers, or third-party software can execute local code.
• Use enterprise patch tooling to identify all affected Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 assets and track remediation to completion.
• Treat this as a privilege-escalation risk that may be chained with other initial-access vulnerabilities; review systems with recent malware, phishing, web shell, VPN, RDP, or credential-theft alerts for possible follow-on privilege escalation.
• Enforce least privilege by minimizing local administrator membership, limiting interactive logon rights, and removing unnecessary privileges from service accounts.
• Enable or tune endpoint detection for suspicious local privilege escalation behavior, including unexpected SYSTEM shells, abnormal child processes from user-writable paths, tampering with security tools, and credential dumping attempts.
• Use application control, attack surface reduction rules, and script restrictions to reduce the likelihood that a low-privileged attacker can execute exploit code before patching is complete.
• Monitor Microsoft’s Security Update Guide, exploit databases, and threat intelligence sources for any change in exploit maturity, public proof-of-concept availability, or KEV status.
• For high-value systems that cannot be patched quickly, increase logging and EDR sensitivity, restrict local access, and consider isolation until remediated.