CVE-2026-35415

What it actually does

CVE-2026-35415 is a local privilege escalation vulnerability in the Windows Storage Spaces Controller caused by an integer overflow or wraparound condition. A user who already has valid local code execution with low privileges can trigger the vulnerable storage component and potentially cause incorrect size calculations or memory handling in privileged Windows code. Successful exploitation can allow elevation to high privileges, likely SYSTEM or equivalent kernel-level control, resulting in full confidentiality, integrity, and availability impact on the affected host.

Why it matters to the business

This vulnerability turns an initial low-privilege foothold on a Windows workstation or server into full local control, which can enable credential theft, security tool tampering, data access, persistence, lateral movement, and ransomware deployment. It is not a standalone remote entry point because the attacker must already be authenticated and able to run code locally, and current public signals show low EPSS, stable exploit probability, no known KEV listing, no known ransomware use, and no public exploit maturity; however, privilege escalation bugs in Windows remain important because they are commonly chained with phishing, stolen credentials, remote access abuse, or application exploits.

How an attack unfolds

An attacker first obtains low-privileged access to an affected Windows system, such as through stolen credentials, malware execution, an exposed remote access pathway, or compromise of a standard user account. From that foothold, the attacker runs a specially crafted local program that interacts with the Windows Storage Spaces Controller and supplies values designed to trigger the integer overflow or wraparound. If the vulnerable code mishandles the resulting calculation, the attacker may gain execution in a more privileged context. After privilege escalation, the attacker can attempt to dump credentials, disable defenses, install persistence, access protected files, modify system settings, or use the compromised host to move deeper into the network.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows 10, Windows 11, and Windows Server versions, including Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2012/2016/2019/2022/2022 23H2, and Windows Server 2025. Because exact fixed build numbers were not provided, use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, Intune, or the Microsoft Update Catalog to deploy the cumulative update released on or after the May 2026 security release for the applicable OS branch. Prioritize internet-facing jump hosts, servers with interactive logon, VDI fleets, administrator workstations, and systems where low-privileged users can run arbitrary code. If immediate patching is not possible, reduce risk by enforcing least privilege, limiting interactive logon rights, restricting local code execution, applying application control, monitoring privileged process creation, and ensuring EDR tamper protection is enabled. Do not disable or alter Storage Spaces components without testing, because doing so may affect storage availability and is not a reliable substitute for patching.

How to confirm the fix worked

Confirm that each affected Windows system has installed the relevant cumulative security update released on or after 2026-05-12 for its OS version. Validate through Windows Update history, enterprise patch compliance tooling, installed hotfix inventory, OS build information, or Microsoft-provided vulnerability assessment data. Confirm that unsupported or end-of-service Windows builds are upgraded to supported releases or covered by applicable extended security updates. Where feasible, verify that Storage Spaces-related system binaries and drivers are from the patched Microsoft update package. A vulnerability scanner should no longer report CVE-2026-35415 after the system is fully updated and rebooted if required.

Typical attack path

1. Gain valid low-privileged local access to an affected Windows workstation or server.
2. Transfer or compile a local exploit program that targets the Windows Storage Spaces Controller.
3. Execute the exploit from the low-privileged account without requiring user interaction.
4. Trigger the integer overflow or wraparound condition in the storage controller component.
5. Obtain elevated privileges such as local administrator or SYSTEM.
6. Use elevated access to disable controls, collect credentials, establish persistence, access sensitive data, or support lateral movement.

How to detect it

There are no public exploit-specific indicators, named threat actors, KEV activity, or known ransomware campaigns associated with this vulnerability in the provided data. To check for possible prior exploitation, focus on behavioral evidence of local privilege escalation after an initial low-privileged logon. Review Windows Security logs for suspicious process creation, service creation, scheduled task creation, privilege use, and account changes, especially where a standard user session is followed by SYSTEM-level execution. Useful event sources include Security events 4624, 4672, 4688, 4697, 4698, 4720, 4732, 7045 from the System log or Service Control Manager, PowerShell Operational logs, Sysmon process/file/driver telemetry where deployed, EDR alerts, and storage-related Windows event channels. Hunt for unusual unsigned or recently dropped executables launched from user-writable paths, followed by elevated shells, credential dumping tools, defense tampering, new services, or persistence. Because the vulnerable component is local and kernel-adjacent, absence of a crash or log entry does not prove absence of exploitation; prioritize correlation of user context changes and suspicious post-escalation activity.

What your security team should do

• Patch affected Windows endpoints and servers through the normal cumulative update process, prioritizing systems with interactive users, administrative tooling, shared access, or high-value data.
• Treat this as a post-compromise privilege escalation risk: pair patching with hunts for suspicious local privilege escalation behavior rather than waiting for internet-facing exposure evidence.
• Review accounts with local logon rights and remove unnecessary local administrator, Remote Desktop, service, and batch logon permissions.
• Use application control or allowlisting to reduce the ability of standard users to execute untrusted local binaries.
• Monitor for low-privileged users spawning elevated shells, creating services, modifying security tools, dumping credentials, or accessing LSASS after unusual process activity.
• Ensure endpoint protection, tamper protection, PowerShell logging, command-line auditing, and Windows Security event collection are enabled on affected systems.
• Because EPSS is currently low and there is no KEV or known ransomware association, schedule remediation according to high-severity local privilege escalation policy, but accelerate for critical servers and privileged access workstations.