Vulnerabilities

CVE-2026-80093 is a use-after-free memory-safety flaw (CWE-416) in the Windows Cloud Files Mini Filter Driver (cldflt.sys), the in-box kernel filesystem filter that backs cloud placeholder files via the Cloud Files API. An attacker who already holds valid low-privilege credentials on a host triggers the flaw through specific operations against cloud-files placeholders, causing the driver to reference freed kernel memory; the High attack-complexity rating indicates the required conditions do not line up trivially. A successful exploit elevates the attacker's privileges locally, granting full control of the affected machine with high impact to confidentiality, integrity, and availability — the flaw is not remotely exploitable on its own. Virtually every maintained Windows 10/11 and Windows Server deployment ships this driver, so any Windows host where untrusted users can run code is plausibly affected; the available data does not list specific affected builds, and fixes shipped in Microsoft's September 2026 Patch Tuesday. As of the data available there is no public PoC, the CVE is not in CISA KEV, and EPSS is low (0.3%, 28th percentile), indicating no confirmed exploitation in the wild; while the September 2026 release included two zero-days, whether this CVE is among them is not confirmed here.

Do: Apply Microsoft's September 2026 Windows cumulative security updates to all Windows 10/11 clients and Windows Servers, prioritizing multi-user hosts such as RDS/VDI servers, terminal servers, and shared workstations where local logon is common. Because exploitation requires valid local credentials, an interim mitigation is to restrict interactive logon, RDP, and local account creation to trusted users on unpatched hosts. After patching, verify on critical systems that the updated cldflt.sys file version from the September 2026 update is in place.

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Microsoft SharePoint Server is affected by a weak authentication vulnerability (CWE-1390) that allows an unauthorized attacker to bypass a security feature over a network. Per the CVSS vector, exploitation requires no privileges and no user interaction with low attack complexity, so any unauthenticated attacker with network access to a vulnerable server can trigger it remotely. Impact to confidentiality and integrity is rated high (CVSS 9.1, critical), meaning the bypass effectively grants the attacker access that authentication should have prevented, with no direct availability impact. All organizations running on-premises Microsoft SharePoint Server are potentially affected; the source data does not specify affected version ranges or fixed builds, so defenders should consult Microsoft's advisory for those details. The flaw is under active exploitation: a public proof-of-concept is available on GitHub, attackers began exploiting it after the PoC went public, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18 (EPSS ~40%, 99th percentile; ransomware association unknown).

Do: Apply Microsoft's security update for CVE-2026-55040 immediately, prioritizing internet-facing SharePoint servers, and comply with CISA BOD 26-04 and the agency's Forensics Triage Requirements, including checking for signs of prior compromise on SharePoint servers. Use the public GitHub proof-of-concept to validate patching and detection coverage, and restrict network exposure of SharePoint until all servers are updated.

Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.

Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copy_size = stride * abs(roi_height) but does not check the source buffer length before a memmove call.