CVE-2026-58613

What it actually does

CVE-2026-58613 is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Cloud Files Mini Filter Driver, commonly associated with cloud file placeholder and sync functionality. A low-privileged, authenticated local attacker can trigger unsafe memory reuse in kernel context and potentially execute code with elevated privileges, resulting in full compromise of confidentiality, integrity, and availability on the affected Windows host. The CVSS vector indicates local access is required, attack complexity is low, no user interaction is needed, and successful exploitation can grant high-impact control over the system.

Why it matters to the business

An attacker who already has limited access to an affected Windows workstation or server could use this flaw to become an administrator or SYSTEM-level user, disable security controls, steal sensitive data, install persistence, or move laterally. Because the affected product range includes widely deployed Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems, exposure may be broad across enterprise endpoints and servers. Although it is not currently listed in CISA KEV and EPSS is low, exploit availability increases operational urgency, especially on shared workstations, jump boxes, VDI hosts, developer systems, and servers where local code execution by lower-privileged users is possible.

How an attack unfolds

An attacker first obtains local authenticated access to a vulnerable Windows system, such as through stolen credentials, malware execution, phishing that results in code execution, or access to a low-privileged account. The attacker then runs a purpose-built exploit that interacts with Cloud Files functionality handled by the Windows Cloud Files Mini Filter Driver. By carefully triggering allocation and release behavior, the exploit causes the driver to reference memory after it has been freed. The attacker then attempts to control or influence the freed memory contents so that subsequent kernel execution follows attacker-controlled data or corrupts kernel structures. If successful, the exploit elevates the attacker from a standard user context to a privileged local context such as administrator or SYSTEM. From there, the attacker can dump credentials, disable endpoint protections, modify files and services, install persistence, or use the host as a launch point for additional activity.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-58613 for all affected Windows versions, including Windows 10 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; Windows Server 2019; Windows Server 2022; and Windows Server 2025. Because no fixed build numbers were provided in the input, use the applicable Microsoft cumulative update for the affected operating system release and verify that the update supersedes the vulnerable Cloud Files Mini Filter Driver version. Prioritize systems where untrusted or lower-privileged users can execute code, including endpoints, terminal servers, VDI, jump hosts, build servers, and internet-facing servers that could be used after initial compromise. Where immediate patching is not possible, reduce local attack opportunities by enforcing least privilege, restricting interactive logon, limiting execution of untrusted binaries, enabling attack surface reduction rules, monitoring local privilege escalation behavior, and ensuring endpoint detection controls are active. Do not rely on disabling cloud file sync alone as a complete mitigation unless Microsoft specifically documents it as effective for this vulnerability.

How to confirm the fix worked

Confirm remediation by verifying that each affected system has installed the relevant Microsoft cumulative security update released for this issue or a later superseding update. Validate through enterprise patch management, Windows Update history, Microsoft Update Compliance, or direct host checks using tools such as Get-HotFix, system build inventory, and file version inspection of the Cloud Files Mini Filter Driver where applicable. Confirm that vulnerable OS releases are not missing the July 2026 or later security update that contains the fix. Exposure can be checked by identifying Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 assets that have not received the applicable cumulative update. After patching, perform a controlled reboot if required, confirm the updated driver is loaded, and monitor for recurring crashes or exploit-like behavior involving cldflt.sys.

Typical attack path

1. Gain local authenticated access to an affected Windows workstation or server.
2. Confirm the system is running a vulnerable Windows version and that the Cloud Files Mini Filter Driver is present or active.
3. Execute a local exploit targeting the use-after-free condition in the Cloud Files Mini Filter Driver.
4. Manipulate freed kernel memory to obtain elevated privileges.
5. Spawn or inject into a privileged process, commonly resulting in administrator or SYSTEM-level execution.
6. Disable defenses, collect credentials, establish persistence, or move laterally using the newly elevated privileges.

How to detect it

Detection should focus on evidence of local privilege escalation, abnormal kernel-driver instability, and post-exploitation activity rather than a single definitive network indicator, because this is a local kernel vulnerability. Review Windows Security logs, Sysmon or EDR telemetry, PowerShell logs, service creation events, scheduled task activity, crash dumps, and Windows Error Reporting artifacts. Look for low-privileged user processes spawning elevated command shells, PowerShell, credential dumping tools, service-control utilities, or processes running as SYSTEM without a corresponding administrative workflow. Investigate unexpected crashes or bugchecks referencing the Cloud Files Mini Filter Driver, especially if followed by successful elevated process creation, new local administrators, security control tampering, LSASS access, suspicious driver loading, or persistence creation. Useful Windows event sources include Security.evtx, System.evtx, Microsoft-Windows-PowerShell/Operational, Microsoft-Windows-Sysmon/Operational, Microsoft-Windows-Windows Defender/Operational, and EDR kernel telemetry. Pay particular attention to Event ID 4688 for suspicious process creation, 4672 for special privileges assigned to a new logon, 7045 for new service installation, 4697 for service installation where enabled, 4698 for scheduled task creation, 1102 for audit log clearing, Defender tamper or exclusion events, and crash reports or memory dumps naming cldflt.sys. Because public exploit availability is indicated, also hunt for downloaded or staged local exploit binaries, unusual execution from user-writable directories, and privilege escalation activity shortly after initial access events.

• cldflt.sys
• CldFlt
• Cloud Files Mini Filter Driver
• BugCheck
• Probably caused by : cldflt.sys
• FAULTING_MODULE: cldflt.sys
• \SystemRoot\System32\drivers\cldflt.sys
• C:\Windows\System32\drivers\cldflt.sys
• Event ID 7045
• Event ID 4697
• Event ID 4698
• Event ID 4672
• Event ID 4688
• Event ID 1102
• sc.exe create
• schtasks.exe /create
• whoami /priv
• whoami /groups
• powershell.exe -ExecutionPolicy Bypass
• cmd.exe /c whoami
• net localgroup administrators
• vssadmin.exe Delete Shadows
• wevtutil.exe cl

What your security team should do

• Prioritize patching of affected Windows endpoints and servers, especially systems allowing local user logon, RDP access, VDI sessions, developer workloads, or multi-user access.
• Treat exploit availability as a reason to accelerate remediation despite the low EPSS score and lack of current KEV listing.
• Inventory Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems and correlate them with cumulative update installation status.
• Hunt for signs of local privilege escalation followed by credential access, defense evasion, new services, suspicious scheduled tasks, or unexpected SYSTEM-level process creation.
• Restrict local administrator rights and interactive logon privileges while patch deployment is in progress.
• Ensure endpoint protection, tamper protection, credential protection, and PowerShell/script logging are enabled on high-risk systems.
• Review EDR telemetry for abnormal process trees where a low-privileged user process rapidly transitions to elevated execution without a legitimate administrative action.
• Increase monitoring on systems that cannot be patched immediately and isolate or limit access to high-value unpatched hosts.