CVE-2026-58536

This is a Windows security flaw that can be abused to “upgrade” someone’s access level on the same machine. The problem is a memory-handling mistake (a “use-after-free”), and the effect is gaining higher privileges than the attacker should have. In a real attack, that can turn a limited foothold into near-full control of the device.

This matters if your organization runs any of these systems: Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025. Because the impact described is local privilege escalation by an authorized attacker, it is most relevant where an attacker (or malware) already has a valid way to run on the machine (for example, via stolen credentials or a local account). Only a risk if the attacker can reach the local environment with authorization (not just by contacting the server from the internet).

Mark this as urgent (RED) because it enables local elevation of privilege on affected Windows versions, which is the kind of step attackers need after they get a foothold. Even though there is no confirmed CISA KEV entry and no clear dated public exploitation report in the provided sources, the fix is available and patching removes a high-value target from your environment. The patch is the primary and most reliable action for reducing risk right now.

1. Confirm whether your machines are in-scope.
   • On each device, capture the OS name and build number.
   • Windows: run winver and note the “Version” and build (for example, 10.0.xxxx.x).
2. Determine whether you are already fixed.
   • Apply the fixed build thresholds from Microsoft’s update guide for CVE-2026-58536.
   • Windows 10: fixed in 10.0.17763.9020 or 10.0.19044.7548 or 10.0.19045.7548.
   • Windows 11: fixed in 10.0.26100.8875 or 10.0.28000.2525.
   • Windows Server 2019: fixed in 10.0.17763.9020.
   • Windows Server 2022: fixed in 10.0.20348.5386.
   • Windows Server 2025: fixed in 10.0.26100.33158.
3. Patch using Microsoft’s guidance.
   • Install the Windows update(s) that include the fix for CVE-2026-58536.
   • Reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58536
4. Validate after installation.
   • Reboot the device(s) after updates.
   • Re-run winver (or check Settings → System → About) and verify the build now matches or exceeds the fixed value for your OS.
5. If you cannot patch immediately (temporary measures).
   • Reduce the chance of local footholds: enforce strong credential hygiene and limit who can log on locally.
   • Review and tighten account access for local logons on workstations and servers.
   • Prioritize patching for any machines that are exposed to credential theft risks (phishing, reused passwords) or that already have unusual local activity.
6. What to monitor.
   • Look for signs of local account compromise or unusual privilege changes (for example, new admin accounts, unexpected elevation activity, or anomalous authentication patterns). Keep monitoring after patching to ensure no ongoing compromise.

CISA KEV deadline: Not provided for this CVE in the provided findings (not listed in KEV).

Severity is rated HIGH by the provided CVSS (7.8). The underlying weakness is CWE-416 (use-after-free), where the driver can incorrectly reuse freed memory, which can be shaped into an elevation-of-privilege outcome. The described effect is specific to the Windows Cloud Files Mini Filter Driver and results in local privilege escalation when a local, authorized attacker can trigger the condition.

Exploitation status in the provided sources: not listed in CISA KEV; no clear dated press claim of exploitation; no public exploit code on record. A predictive EPSS value is provided (1.8%), but since there is no KEV confirmation in the findings, exploitation likelihood remains uncertain; regardless, patch availability plus local high-impact capability is why this is treated as RED.