Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVE-2026-33835)

A recent Microsoft security advisory identified a critical flaw in the Windows Cloud Files Mini Filter Driver, assigned CVE‑2026‑33835. The driver, which underpins the Cloud Files feature that caches files from OneDrive and other cloud services, fails to properly validate user‑supplied data. An attacker who can execute code in a user context can trigger the vulnerability and elevate privileges to the SYSTEM level.

Impact

• Local privilege escalation to SYSTEM on Windows 10 (22H2+), Windows 11 (24H2+), Windows Server 2022 and 2025.
• Potential to install persistence mechanisms, exfiltrate data, or pivot to other systems.
• No remote exploitation vector; requires local access.

Mitigation

• Install the 2026 cumulative security update (KBxxxxxx) for all affected Windows versions.
• Verify the update installation via the Windows Update history or the Security Update Guide.
• As a temporary measure, disable the Cloud Files feature via Group Policy (Computer Configuration\Administrative Templates\Windows Components\Cloud Files\Turn off Cloud Files). This removes the vulnerable driver from the system.

What to Do

• Apply the patch immediately; it is rated CVSS 9.8 and is a critical update.
• Audit systems for signs of privilege escalation or unexpected SYSTEM processes.
• Review and tighten local user permissions to limit the attack surface for future local exploits.
• Maintain a regular patch cadence and monitor Microsoft’s Security Update Guide for related advisories.

Microsoft recommends treating this vulnerability as a critical priority and applying the update without delay to prevent potential exploitation by attackers with local access.