This critical vulnerability in the Windows Cloud Files Mini Filter Driver is currently being exploited in the wild and enables local privilege escalation.

This flaw is a use after free vulnerability located in the Windows Cloud Files Mini Filter Driver. It requires the attacker to have local access and be authenticated to the system to trigger the memory corruption, which subsequently allows for privilege escalation.

Successful exploitation of this vulnerability allows an attacker to elevate their privileges to a higher level, potentially granting them administrative control over the compromised host. Given the CVSS score of 9.5 and the confirmation of active exploitation in the wild, the business impact is severe, posing a significant risk to the integrity and confidentiality of enterprise systems.

Immediate Action: Apply the security updates provided in the Microsoft Security Update Guide immediately to all affected Windows endpoints.

Proactive Monitoring: Monitor system logs for suspicious process creation or unexpected behavior involving the Cloud Files Mini Filter Driver.

Compensating Controls: Ensure that endpoint protection solutions are fully updated and active to detect and block known exploit patterns associated with this CVE.

Public Exploit Available: Yes, multiple public proofs of concept exist on GitHub.

Due to the confirmed active exploitation and the critical severity of this privilege escalation flaw, organizations should prioritize patching as an emergency task. Administrators must verify that all applicable Windows versions listed are updated to the specified non-vulnerable versions to prevent unauthorized system control.