CVE-2026-33835

What it actually does

CVE-2026-33835 is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Cloud Files Mini Filter Driver, commonly associated with cldflt.sys. An authenticated local attacker can trigger improper kernel memory reuse and potentially execute code with kernel-level privileges, resulting in full compromise of confidentiality, integrity, and availability on the affected Windows host. The CVSS score is 7.8 with low attack complexity, local access required, low privileges required, and no user interaction required.

Why it matters to the business

Successful exploitation can turn a low-privileged foothold into full administrative control of a Windows workstation or server. This can enable credential theft, security tool tampering, lateral movement, data access, ransomware staging, and persistence. Because affected products include widely deployed Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 versions, exposure may be broad across enterprise endpoint and server fleets. The vulnerability is not currently listed in CISA KEV, has no known ransomware association, and has a low but nonzero EPSS score that has remained stable over 30 days, so remediation should be prioritized through normal high-severity Windows patch cycles, with higher urgency for systems exposed to untrusted local users or shared-access workloads.

How an attack unfolds

An attacker first obtains any authenticated local execution context, such as a standard user account, compromised application account, or code execution through another vulnerability. The attacker then runs a specially crafted program that interacts with Windows cloud file placeholder or synchronization functionality handled by the Cloud Files Mini Filter Driver. By manipulating driver-managed objects so that memory is freed and then reused while still referenced, the exploit attempts to corrupt kernel memory in a controlled way. If successful, the attacker pivots from user mode into kernel execution or abuses kernel memory corruption to modify security tokens, grant elevated privileges, disable protections, or spawn a process as SYSTEM. From there, the attacker can perform post-exploitation actions such as dumping credentials, installing persistence, disabling defenses, moving laterally, or deploying additional payloads.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-33835 for each affected Windows version. Because exact fixed build numbers were not provided in the input, validate remediation against the Microsoft Security Update Guide and ensure systems have installed the applicable May 2026 or later cumulative security update for Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025 as applicable. Prioritize shared workstations, VDI hosts, jump boxes, developer workstations, terminal servers, domain-adjacent administration systems, and servers where non-administrative users can execute code. If immediate patching is not possible, reduce risk by limiting local interactive access, removing unnecessary user privileges, restricting execution of untrusted binaries, increasing EDR monitoring for local privilege escalation behavior, and, only where operationally safe, disabling or restricting Cloud Files and Files On-Demand functionality that depends on the Cloud Files Mini Filter Driver. Test any driver or feature disablement carefully, as it may disrupt OneDrive, cloud-sync, placeholder-file, or enterprise file virtualization workflows.

How to confirm the fix worked

Confirm that each affected system has the applicable cumulative Windows security update installed for its OS version. Use enterprise patch management, Windows Update compliance reporting, Microsoft Defender Vulnerability Management, WSUS, Intune, SCCM, or equivalent tooling to verify update status. On individual hosts, confirm the installed OS build and recent hotfixes using commands such as winver, systeminfo, Get-ComputerInfo, and Get-HotFix, then compare the results to Microsoft’s fixed build guidance for CVE-2026-33835. Also verify the installed cldflt.sys file version and timestamp under C:\Windows\System32\drivers\cldflt.sys against the patched version documented by Microsoft. Exposure remains if the host is an affected Windows version and has not received the applicable cumulative update. After patching, perform regression checks for OneDrive Files On-Demand, cloud storage integrations, and file synchronization workflows that rely on Cloud Files functionality.

Typical attack path

1. Obtain low-privileged local access to an affected Windows workstation or server.
2. Run a purpose-built local exploit targeting the Windows Cloud Files Mini Filter Driver.
3. Trigger the use-after-free condition through crafted file-system or cloud-file operations.
4. Corrupt kernel memory to elevate the attacker-controlled process or token to SYSTEM-level privileges.
5. Use elevated access to disable defenses, access sensitive data, dump credentials, install persistence, or move laterally.

How to detect it

This vulnerability is a local privilege escalation issue and is unlikely to produce network-level indicators by itself. Detection should focus on host telemetry before and after suspicious elevation events. Review Windows Security logs for unusual process creation, new privileged logons, assignment of special privileges, service creation, and defense tampering, especially where the parent process originally ran as a standard user and then quickly spawned SYSTEM-level tools. Useful Windows events include 4688 for process creation, 4672 for special privileges assigned, 4624 for new logons, 7045 for service installation, and 1102 for audit log clearing. If Sysmon is deployed, review Event ID 1 for process creation, Event ID 7 for image loads involving cldflt.sys context where available, Event ID 10 for suspicious process access such as LSASS access after elevation, Event ID 11 for suspicious file creation, and Event ID 13 for persistence-related registry changes. Review EDR telemetry for kernel exploit behavior, token theft, privilege escalation detections, or a low-integrity or medium-integrity user process becoming SYSTEM without an expected installer, updater, or management agent workflow. Check System and Application logs, Windows Error Reporting, minidumps, and crash dumps for bugchecks or application crashes referencing cldflt.sys, the Cloud Files Mini Filter Driver, or file-system filter driver instability. Post-exploitation hunting should include suspicious SYSTEM shells, credential-dumping attempts, new local administrators, new scheduled tasks, new services, disabled security products, and unexpected modifications to cloud-sync directories. There are no public exploit-specific IOCs or known threat actors reported in the provided data, so behavioral and forensic detection is required.

• C:\Windows\System32\drivers\cldflt.sys
• cldflt.sys
• Cloud Files Mini Filter Driver
• CldFlt
• BugCheck
• Event ID 1001
• Event ID 4688
• Event ID 4672
• Event ID 7045
• Event ID 1102
• Event ID 1
• Event ID 10
• Event ID 11
• Event ID 13
• NT AUTHORITY\SYSTEM
• powershell.exe -enc
• cmd.exe /c whoami /all
• whoami /priv
• procdump.exe -ma lsass.exe
• rundll32.exe comsvcs.dll, MiniDump
• wevtutil cl
• vssadmin delete shadows
• bcdedit /set {default} recoveryenabled No

What your security team should do

• Inventory all affected Windows desktop and server versions and map them to patch compliance status for the Microsoft update addressing CVE-2026-33835.
• Prioritize patching systems that allow local user logon, host multiple users, support VDI or RDS access, or are used for administration.
• Ensure endpoint detection and response tools alert on local privilege escalation patterns, especially low-privileged processes spawning SYSTEM shells or tampering with security controls.
• Hunt for evidence of suspicious privilege escalation, cldflt.sys-related crashes, abnormal token manipulation, and post-exploitation behavior around the time of any suspected compromise.
• Limit local interactive access and remove unnecessary local administrator rights while remediation is in progress.
• Restrict execution from user-writable directories using application control where feasible.
• Validate that cloud file synchronization and placeholder-file features continue to operate normally after patch deployment.
• Track Microsoft Security Update Guide updates for fixed build numbers, supersedence information, and any later exploitability assessment changes.