CVE-2026-58536

What it actually does

This vulnerability is a local privilege escalation flaw caused by a use-after-free condition in the Windows Cloud Files Mini Filter Driver. An attacker who already has valid low-privileged local access can trigger improper object lifetime handling in the kernel-mode file-system filter driver and potentially execute code with elevated privileges, commonly up to NT AUTHORITY\SYSTEM. Successful exploitation can provide full control over the affected Windows host, including the ability to read or modify protected data, disable security controls, install persistence, and tamper with system processes.

Why it matters to the business

If exploited, this flaw can turn a standard compromised Windows user account into full administrative control of the machine. That increases the impact of phishing, stolen credentials, malware execution, or insider misuse by allowing attackers to disable endpoint defenses, access sensitive files, dump credentials, move laterally, or deploy ransomware from an initially limited foothold. It affects multiple supported Windows desktop and server versions, including Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025, so organizations should treat it as a broad endpoint and server hardening priority even though it is not currently listed in CISA KEV and no public exploit maturity is reported.

How an attack unfolds

An attacker must first obtain the ability to run code locally on an affected Windows system, such as through a compromised user account, malicious document, malware dropper, exposed remote access session, or prior exploitation of another vulnerability. The attacker then runs a specially crafted program that interacts with Cloud Files functionality handled by the Windows Cloud Files Mini Filter Driver. By manipulating file or cloud placeholder operations in a way that triggers the use-after-free condition, the exploit attempts to cause the driver to reference memory after it has been released. With reliable memory grooming, that freed memory can be replaced with attacker-controlled data, allowing kernel execution flow or object state to be corrupted. A successful exploit elevates the attacker's privileges from a normal local user to a highly privileged context, after which the attacker can create administrator accounts, dump credentials, disable security tooling, install services or drivers, and use the host as a launch point for further compromise.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions: Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 24H2, Windows 11 25H2, Windows 11 26H1, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Where possible, prioritize systems that allow interactive user logon, developer workstations, shared workstations, VDI images, jump hosts, file servers, and servers where compromise of a low-privileged account would have high downstream impact. If immediate patching is not possible, reduce exposure by limiting local logon rights, enforcing least privilege, restricting execution of untrusted binaries, hardening application control policies, ensuring endpoint detection and response is active, and monitoring for suspicious privilege escalation behavior. Because this is a kernel local privilege escalation issue, configuration-only mitigations should be treated as temporary risk reduction rather than a substitute for patching.

How to confirm the fix worked

Confirm that affected systems have installed the relevant Microsoft cumulative security update released for this vulnerability or a later cumulative update. Validate through centralized patch management, Windows Update history, Microsoft Update Compliance, Intune, Configuration Manager, WSUS, or vulnerability scanning tools that map installed build and KB levels to the remediated Windows version. Reboot systems after patch installation where required, because kernel driver fixes generally do not take full effect until restart. On representative endpoints and servers, verify that the OS build number reflects the patched baseline and that no vulnerable images remain in golden images, VDI templates, offline server images, or deployment media. Exposure can also be checked by inventorying supported Windows 10, Windows 11, and Windows Server versions that have not received the July 2026 or later cumulative security update containing the fix.

Typical attack path

1. Gain low-privileged local code execution on an affected Windows workstation or server.
2. Run a crafted local exploit that targets the Windows Cloud Files Mini Filter Driver.
3. Trigger Cloud Files-related file operations that cause the vulnerable driver to access freed memory.
4. Manipulate kernel memory layout so the freed object is replaced or influenced by attacker-controlled data.
5. Achieve elevated code execution, typically as SYSTEM or an equivalent high-privilege context.
6. Disable defenses, access protected data, dump credentials, establish persistence, or move laterally.

How to detect it

Detection should focus on evidence of local privilege escalation following initial local code execution, because the vulnerable component is a kernel-mode driver and exploitation may not leave a unique application log entry. Collect and review Windows Security logs, Sysmon or EDR telemetry, PowerShell logs, service control events, driver load events, crash dumps, and endpoint protection alerts. Look for low-privileged user processes spawning SYSTEM-level shells or tools, unexpected creation of services or scheduled tasks, addition of users to local Administrators, credential dumping activity, tampering with Microsoft Defender or EDR services, and suspicious interaction with Cloud Files or file-system filter driver behavior shortly before privilege changes. Kernel exploitation attempts may also produce bug checks, unexpected system crashes, or dump files referencing Cloud Files filter components. Since no public exploit artifacts are identified from the provided intelligence, detections should be behavioral rather than signature-only, with correlation between a standard user process and a sudden privileged action on the same host.

• CldFlt.sys
• Microsoft-Windows-FilterManager
• Microsoft-Windows-CloudFiles
• Event ID 7045
• A service was installed in the system
• Event ID 4697
• A service was installed in the system
• Event ID 4720
• A user account was created
• Event ID 4732
• A member was added to a security-enabled local group
• Event ID 4672
• Special privileges assigned to new logon
• Event ID 4688
• whoami /priv
• net localgroup administrators
• net user /add
• sc.exe create
• schtasks /create
• powershell.exe -ExecutionPolicy Bypass
• cmd.exe /c whoami
• procdump.exe -ma lsass.exe
• rundll32.exe comsvcs.dll, MiniDump
• reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• wevtutil cl Security
• sc.exe stop WinDefend
• Set-MpPreference -DisableRealtimeMonitoring $true
• SYSTEM process spawned from low-privileged user context
• unexpected bugcheck referencing CldFlt.sys

What your security team should do

• Prioritize deployment of the Microsoft security update across all affected Windows endpoints and servers, with highest priority for systems used by administrators, exposed through remote access, or containing sensitive data.
• Review patch compliance for Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including VDI templates and base images.
• Monitor for local privilege escalation behavior such as unexpected SYSTEM shells, suspicious service creation, new local administrators, credential dumping, or attempts to disable endpoint protection.
• Enforce least privilege by removing unnecessary local administrator rights and limiting interactive logon to servers.
• Use application control, attack surface reduction rules, and endpoint protection to reduce the chance that a low-privileged attacker can execute a local exploit binary.
• Investigate recent endpoint alerts where a low-privileged process spawned privileged processes, modified services, loaded drivers, or tampered with security tools.
• Because no public exploit maturity and no KEV listing are currently reported, track Microsoft advisories and threat intelligence for any change in exploitation status, but do not delay routine patching.