CVE-2026-35418

What it actually does

CVE-2026-35418 is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Cloud Files Mini Filter Driver, commonly associated with Cloud Files and Files On-Demand functionality. A low-privileged, authenticated local attacker can trigger unsafe reuse of freed kernel memory through crafted file-system or Cloud Files interactions. Successful exploitation can allow code execution in kernel context or manipulation of security-sensitive kernel objects, resulting in elevation to SYSTEM-level privileges with full confidentiality, integrity, and availability impact on the affected host.

Why it matters to the business

An attacker who already has a foothold on an affected Windows workstation or server can use this flaw to gain complete control of that machine, disable security tooling, steal credentials, move laterally, or deploy malware. Because the affected product set spans Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025, exposure may be broad across enterprise endpoints and servers. Current public exploitation signals are low: it is not listed in CISA KEV, is not known to be used in ransomware campaigns, has no reported exploit maturity, and has a low, flat EPSS score; however, local privilege escalation bugs are commonly chained after phishing, malware execution, or exploitation of an initial-access vulnerability.

How an attack unfolds

An attacker first needs the ability to run code locally as an authenticated, low-privileged user on an affected Windows system. They then execute a purpose-built program that interacts with Cloud Files or file-system operations handled by the Windows Cloud Files Mini Filter Driver. The program manipulates object lifetime or request timing so the driver references memory after it has been freed. By shaping memory reuse, the attacker attempts to convert the use-after-free condition into controlled kernel memory corruption. A reliable exploit would typically use that primitive to alter process token data, security descriptors, or kernel control flow, resulting in execution with SYSTEM privileges. After privilege escalation, the attacker can install persistence, dump credentials, tamper with endpoint defenses, access protected data, or use the host as a staging point for lateral movement.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-35418 for all affected Windows versions, including Windows 10 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, and 26H1; Windows Server 2019; Windows Server 2022; Windows Server 2022 23H2; and Windows Server 2025. Because no exact fixed build numbers were provided in the input, confirm the required cumulative update or servicing stack guidance in the Microsoft Security Update Guide for the relevant OS release. Prioritize internet-facing servers, shared multi-user systems, VDI hosts, developer workstations, and systems where untrusted users can execute code. Where patching must be delayed, reduce risk by preventing untrusted local code execution, enforcing application control such as Windows Defender Application Control or AppLocker, restricting local interactive access, removing unnecessary local administrator rights, and ensuring endpoint protection has kernel exploit and behavioral detection enabled. If Cloud Files functionality is not required, organizations may evaluate disabling or restricting related functionality only after compatibility testing, as doing so can affect OneDrive, Files On-Demand, and applications that rely on Cloud Files APIs.

How to confirm the fix worked

Confirm each affected system has installed the Microsoft cumulative security update that includes the fix for this vulnerability. Validate OS version and patch level using enterprise patch management, vulnerability scanning, Windows Update compliance reporting, or PowerShell commands such as Get-ComputerInfo and Get-HotFix, then compare results with the Microsoft Security Update Guide for the specific Windows release. Confirm that vulnerability scanners no longer report CVE-2026-35418 on patched assets. On representative systems, verify that the Cloud Files Mini Filter Driver file version and OS build are at or above the vendor-patched level once Microsoft-published fixed versions are available. For mitigations, validate that local low-privileged users cannot execute unapproved binaries and that application control policies block unsigned or unauthorized exploit tooling.

Typical attack path

1. Obtain authenticated local access to an affected Windows workstation or server through prior compromise, malware execution, stolen credentials, or legitimate user access.
2. Run a crafted local exploit program from the compromised user context.
3. Trigger vulnerable Cloud Files Mini Filter Driver behavior through specific file-system or Cloud Files operations.
4. Exploit the use-after-free condition to corrupt or reuse kernel memory in a controlled way.
5. Escalate the attacker-controlled process from low privilege to SYSTEM or equivalent local administrative control.
6. Disable defenses, harvest credentials, create persistence, access protected resources, or pivot to additional systems.

How to detect it

There are no widely reported public exploit indicators, named threat actors, KEV activity, or ransomware use associated with this vulnerability based on the provided data, so detection should focus on behavioral evidence of local privilege escalation and post-exploitation. Review endpoint detection telemetry, Windows Security logs, Sysmon logs, PowerShell logs, service control manager logs, scheduled task logs, Defender/EDR alerts, and crash dumps. Look for a low-privileged user process that unexpectedly obtains SYSTEM privileges, spawns cmd.exe or powershell.exe as SYSTEM, creates a new service, installs a driver, disables security tools, dumps credentials, or writes to protected system locations. Investigate Windows Security Event ID 4688 process creation chains where a non-administrative parent process leads to SYSTEM-level child processes; Event ID 4672 indicating special privileges assigned shortly after suspicious process execution; Event ID 7045 for new service installation; Event IDs 4698 or TaskScheduler Operational Event ID 106 for scheduled task creation; and Defender or EDR alerts for credential dumping or tampering. Check System event logs and crash dumps for bugchecks or driver faults referencing cldflt.sys, CldFlt, memory corruption, pool corruption, or use-after-free-like instability, particularly when followed by privilege changes or security tooling tampering. Since exploitation is local, correlate findings with interactive logons, remote management sessions, software deployment activity, and recent file execution from user-writable directories such as Downloads, Temp, Desktop, or AppData.

• cldflt.sys
• CldFlt
• Microsoft-Windows-TaskScheduler/Operational Event ID 106
• Windows Security Event ID 4688
• Windows Security Event ID 4672
• Windows Security Event ID 7045
• Windows Security Event ID 4698
• System event log bugcheck referencing cldflt.sys
• process running as NT AUTHORITY\SYSTEM from a user-writable path
• cmd.exe spawned as NT AUTHORITY\SYSTEM by a non-administrative user process
• powershell.exe spawned as NT AUTHORITY\SYSTEM by a non-administrative user process
• sc.exe create
• schtasks.exe /Create
• wevtutil.exe cl
• vssadmin.exe delete shadows
• reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

What your security team should do

• Patch affected Windows endpoints and servers through the appropriate Microsoft cumulative update cycle, prioritizing high-value servers, shared systems, and hosts used by privileged users.
• Treat this as a post-compromise privilege escalation risk: pair patching with controls that reduce initial access, including phishing defenses, browser hardening, attachment controls, and malware prevention.
• Hunt for suspicious local privilege escalation behavior, especially low-privileged processes spawning SYSTEM shells, creating services, modifying security tools, or accessing credential stores.
• Enable and retain high-quality process creation telemetry, including Windows Security Event ID 4688 or Sysmon Event ID 1, with command-line logging where possible.
• Use application control to prevent untrusted local binaries, scripts, and exploit proof-of-concept tools from running on servers and managed workstations.
• Monitor for abnormal activity involving cldflt.sys or the CldFlt service, especially crashes, driver faulting, or unexpected interactions followed by privilege changes.
• Review local administrator group membership and remove unnecessary local privileges to limit post-escalation blast radius.
• Because EPSS is low and there is no KEV listing or known ransomware use, prioritize according to asset criticality, but do not defer indefinitely because privilege escalation flaws are frequently chained with other vulnerabilities.