CVE-2023-36036KEV · OVERDUECWE-122

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

High · published November 14, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 97.0th percentile for exploit probability.

1053
days past CISA
deadline
CVSS v3.1
7.8
EPSS
17%
Percentile
97.0
In the wild
Confirmed
What it is

⚡ A clever bug in the Windows Cloud Files Mini Filter Driver lets attackers escalate privileges without breaking a sweat! Think of it like a guest sneaking into the VIP section of a concert just by showing a fake wristband — no one stopped them because the bouncer wasn’t paying attention! 🎤 This vulnerability could allow an attacker to gain elevated privileges on the system, giving them the power to execute malicious commands and potentially take control of sensitive data or functions. The consequences could be absolutely devastating for personal and organizational security! 🚨

Put simply

Think of it like a guest sneaking into the VIP section of a concert just by showing a fake wristband — no one stopped them because the bouncer wasn’t paying attention! 🎤 The flaw in the Windows Cloud Files Mini Filter Driver allows an attacker to elevate their privileges, bypassing normal security checks, similar to a VIP pass that bypasses standard entry protocols.

What to do

This vulnerability could allow an attacker to gain elevated privileges on the system, giving them the power to execute malicious commands and potentially take control of sensitive data or functions. The consequences could be absolutely devastating for personal and organizational security! 🚨 To mitigate this risk, install the latest security update from Microsoft immediately. Ensure that all systems running affected Windows versions are patched and verify that unauthorized accounts do not have elevated permissions. You've got this! Follow those steps and your security will be tighter than a drum! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.16670 · 97.0th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2023-11-14T17:57Z
KEV added
2023-11-14 · due 2023-12-05
EPSS history
Timeline
  • 14 NOV 17:57Z
    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
    cvelistv5
  • 14 NOV 00:00Z
    Added to CISA KEV — remediate by Dec 5
    kev