Vulnerabilities
Windows ReFS Elevation of Privilege Vulnerability (CVE-2026-50441) – Immediate Patch Required
A local privilege escalation flaw in Windows ReFS allows attackers with local access to gain SYSTEM rights via a crafted volume. Microsoft has issued a cumulative update; all affected systems must be patched immediately.
What happened
A local privilege escalation flaw was discovered in the Windows Resilient File System (ReFS). CVE-2026-50441 allows an attacker with local access to craft a malicious ReFS volume that can cause the system to execute arbitrary code with SYSTEM privileges.
Impact
The vulnerability is limited to systems that use ReFS volumes and requires local access. Exploitation could lead to full control over the affected machine, enabling lateral movement or persistence.
Mitigation
Microsoft has released a cumulative update that patches the flaw. Apply the latest Windows Update for the following platforms:
- Windows 10 version 22H2 and later
- Windows 11 version 22H2 and later
- Windows Server 2022 and later
Until the patch is applied, restrict physical and remote access to ReFS volumes and remove unnecessary local admin rights.
What to do
Verify that your systems are running the latest cumulative update. Run wmic qfe list brief /format:table to confirm the presence of the patch. Monitor event logs for ReFS-related errors and audit file system access. If a system cannot be patched immediately, consider disabling ReFS or moving critical data to NTFS.
Related vulnerabilities
CVE‑2026‑50332: Windows Kernel Elevation of Privilege Vulnerability – Immediate Update Required
Microsoft has identified CVE‑2026‑50332, a kernel‑level elevation of privilege flaw affecting Windows systems. The vulnerability allows local attackers to gain higher privileges. Defenders should verify patch status and apply the latest cumulative update.
Read briefing
CVE-2026-69328: Windows Storage Elevation of Privilege Vulnerability – Immediate Patch Required
A flaw in Windows Storage lets local users gain SYSTEM privileges by manipulating file metadata. Windows 10 and 11 systems must install the latest security update. Defenders should verify patch status and monitor for anomalous privilege escalation.
Read briefing
CVE-2026-50357: Windows ReFS Elevation of Privilege Vulnerability
A flaw in Windows Resilient File System (ReFS) permits local attackers to elevate privileges on affected systems. Windows machines with ReFS enabled are vulnerable. Apply the latest security update or disable ReFS to mitigate.
Read briefing
Windows exFAT Elevation of Privilege Vulnerability (CVE‑2026‑69619) – Immediate Patch Required
Microsoft released a security update for CVE‑2026‑69619, an elevation‑of‑privilege flaw in the Windows exFAT file‑system driver. The vulnerability allows local attackers to gain SYSTEM rights by manipulating exFAT volumes. All Windows 10/11 and Server 2022 installations that use exFAT are affected; apply the update via Windows Update or WSUS immediately.
Read briefing