CVE-2026-45586

What it actually does

This is a local privilege-escalation vulnerability in the Windows Collaborative Translation Framework caused by improper handling of links before file access. A low-privileged authenticated user can create or manipulate a symbolic link, junction, hard link, or similar reparse-point condition so that a privileged Windows component accesses an attacker-chosen file path. If successfully exploited, the flaw can allow the attacker to perform file operations with elevated privileges, potentially leading to SYSTEM-level code execution or full local compromise. The CVSS score is 7.8, reflecting high confidentiality, integrity, and availability impact, but exploitation requires prior local access.

Why it matters to the business

An attacker who already has a foothold on a Windows workstation or server could use this flaw to become an administrator, disable protections, steal sensitive data, deploy malware, or move laterally. The issue affects many supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2012 through 2025, so enterprise exposure may be broad. It is not currently listed in CISA KEV, is not marked as ransomware-associated, and has low EPSS probability at 0.0363 with no known mature exploit reported, but privilege-escalation bugs are commonly chained with phishing, credential theft, browser exploits, and remote-code-execution vulnerabilities.

How an attack unfolds

An attacker first obtains local code execution as a standard user, such as through phishing, stolen credentials, malicious documents, or exploitation of another vulnerability. The attacker then prepares a controlled filesystem location and creates a link or reparse point that redirects a file operation expected by the Windows Collaborative Translation Framework to a protected target path. When the vulnerable Windows component later performs the file access without safely resolving or validating the link target, the operation occurs in a higher-privileged context. The attacker uses that privileged file operation to modify, replace, or create a sensitive file, which can be leveraged to run code as SYSTEM, weaken security controls, or establish persistence. Because this is local privilege escalation, it is most useful after initial compromise rather than as an internet-facing entry point.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions. Prioritize Windows servers, administrator workstations, jump hosts, shared workstations, VDI images, and systems where untrusted users can log on locally. Where exact fixed build numbers or KBs are not available in the provided data, use Microsoft’s Security Update Guide and Windows Update/WSUS/Microsoft Configuration Manager to deploy the June 2026 or later cumulative security updates for the affected Windows release. Remove or isolate unsupported Windows versions where security updates are not available. As interim risk reduction, restrict local interactive logon rights, limit standard users’ ability to create developer/test artifacts in sensitive paths, enforce least privilege, monitor reparse point creation, and prevent untrusted users from running arbitrary code on shared Windows systems.

How to confirm the fix worked

Confirm each affected Windows system has installed the relevant Microsoft cumulative security update for its OS version. Validate using Windows Update history, WSUS or Configuration Manager compliance reports, vulnerability scanner results, and OS build/KB inventory from PowerShell or endpoint management tooling. Re-scan assets after patch deployment and verify that Windows 10, Windows 11, and Windows Server systems no longer report this vulnerability. For high-risk systems, review local privilege boundaries by confirming non-administrative users cannot write to sensitive directories or create exploitable link chains in locations used by privileged services. If compensating controls are used, test that local standard users cannot create symbolic links or junctions in monitored sensitive paths and that attempted abuse generates alerts.

Typical attack path

1. Gain local authenticated access to a vulnerable Windows workstation or server as a low-privileged user.
2. Identify a filesystem location or workflow used by the Windows Collaborative Translation Framework where link resolution can be abused.
3. Create a crafted symbolic link, junction, hard link, mount point, or other reparse point that redirects a privileged file operation to an attacker-selected target.
4. Trigger the vulnerable framework behavior so the privileged component follows the link and accesses the unintended file path.
5. Use the resulting privileged file write, replacement, deletion, or access to escalate privileges, commonly to local administrator or SYSTEM.
6. Install persistence, dump credentials, disable defenses, or move laterally using the newly elevated privileges.

How to detect it

Detection should focus on signs of local privilege escalation rather than network exploitation, because this vulnerability requires local authenticated access. Review EDR, Sysmon, Windows Security logs, PowerShell logs, and file-integrity telemetry for unusual symbolic link, junction, hard link, or reparse-point creation by standard users, especially when followed by privileged file modification, new service installation, scheduled task creation, driver loading, credential dumping, or tampering with security tools. Useful log sources include Sysmon Event ID 1 for process creation, Sysmon Event ID 11 for file creation, Sysmon Event ID 12/13/14 for registry changes, Sysmon Event ID 15 for alternate data streams, Sysmon Event ID 22 for DNS if follow-on tooling is used, Windows Security Event ID 4688 for process creation, 4672 for special privileges assigned, 4697 for service installation, 4698 for scheduled task creation, 7045 in the System log for new services, and PowerShell 4103/4104 for command and script block logging. Look for low-privileged users running link-creation utilities or APIs, followed shortly by execution as SYSTEM, unexpected local administrator membership changes, new binaries in writable-to-privileged transition paths, or changes to protected files. Since no public exploit maturity or actor-specific tooling is provided, absence of these artifacts does not prove non-exploitation; prioritize correlation of suspicious link manipulation with subsequent privilege gain.

• mklink /D
• mklink /J
• mklink /H
• fsutil hardlink create
• New-Item -ItemType SymbolicLink
• New-Item -ItemType Junction
• CreateSymbolicLink
• DeviceIoControl FSCTL_SET_REPARSE_POINT
• \\?\GLOBALROOT\RPC Control
• IO_REPARSE_TAG_SYMLINK
• IO_REPARSE_TAG_MOUNT_POINT
• EventCode=7045
• EventCode=4697
• EventCode=4698
• EventCode=4672
• EventCode=4688
• ctfmon.exe

What your security team should do

• Patch broadly across affected Windows endpoints and servers, prioritizing systems with local user access, internet-exposed management paths, privileged administration use, or high-value data.
• Use Microsoft Security Update Guide, WSUS, Microsoft Configuration Manager, Intune, or equivalent tooling to map the correct cumulative update to each Windows release and track deployment completion.
• Hunt for recent suspicious reparse point, symbolic link, hard link, or junction creation by non-administrative users, especially followed by privilege changes, service creation, driver loading, or security-tool tampering.
• Correlate local privilege-escalation signals with initial-access events such as phishing execution, suspicious Office child processes, browser exploit activity, remote access tool installation, or unusual logons.
• Restrict local administrator rights and local interactive logon to reduce the blast radius if exploitation occurs.
• Enable or tune Sysmon, EDR, and Windows audit policies to capture process creation, file creation, service creation, scheduled tasks, and security log changes on high-value systems.
• Because the CVE is not currently in KEV and has no reported mature exploit, treat this as important routine patching rather than an emergency internet-wide exposure, unless exploitation indicators appear in your environment.