CVE-2026-62713

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 24th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile24th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which Windows versions and update levels you run (Windows 10/11 and Windows Server 2019/2022/2025), and confirm whether your system has the Cloud Files feature/driver in use.
Verify your current build/update matches one of the vulnerable ranges by comparing against the fixed versions listed by Microsoft for CVE-2026-62713.
Upgrade/patch all affected systems to the fixed updates: Windows 10 (10.0.17763.9121 or 10.0.19044.7663 or 10.0.19045.7663), Windows 11 (10.0.22631.7517 or 10.0.26100.9168 or 10.0.26200.9168 or 10.0.28000.2704), Windows Server 2019 (10.0.17763.9121), Windows Server 2022 (10.0.20348.5499), Windows Server 2025 (10.0.26100.33296), and the additional Windows 10/11 fixed builds listed by Microsoft (10.0.17763.9115, 10.0.26100.9106).
If you cannot patch immediately, restrict who can sign in locally and tighten access to any accounts that could plausibly trigger Cloud Files processing (principle of least privilege).

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-62713 is a Windows Cloud Files security bug that lets a signed-in local user crash or gain higher permissions; if you use Cloud Files and you have untrusted local users, you should act—this is a serious privilege-escalation risk.

CVE-2026-62713 is a heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver that can be triggered by an authenticated local user, allowing elevation of privileges by overflowing memory in the driver.

If you're affected

Local account takeover
Full system compromise risk
Ransomware-enabler privileges
Loss of business continuity

What is it

This Windows bug is in a file-related component called the Cloud Files Mini Filter Driver. If a local user can feed it malicious data in the right way, the bug can overflow memory and let that user gain higher privileges than they should have. Think of it like a small security flaw in a door lock: a person already inside your building can potentially force open the restricted room.

Who is affected

This matters if your business runs Windows 10, Windows 11, or Windows Server 2019/2022/2025 with the Windows Cloud Files component/driver in use. It specifically requires an authenticated local user (so the main risk is from people who already have an account on the machine), and it has no need for clicks or user interaction once the attacker has credentials. The practical risk depends on whether an attacker can reach the Cloud Files driver’s processing path with malicious input—so focus on systems where untrusted or semi-trusted users can log on.

How urgent is it

This should be treated as high urgency because it is a local privilege-escalation bug (it turns an authenticated local user into higher-privilege access), which can quickly enable full system compromise. Even though publicly available exploit code wasn’t found in the records here, security reporting indicates active interest (Lazarus group) and Microsoft has provided fixes—so you should patch on an accelerated schedule.

What to do — in detail

Inventory and scope
- Identify which of these you run: Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, Windows Server 2025.
- For each system, check whether Cloud Files is enabled/used (and confirm the Cloud Files Mini Filter Driver is present as part of your configuration).
Determine whether you’re vulnerable
- Compare each machine’s current Windows build/update level against Microsoft’s fixed versions for CVE-2026-62713.
- Treat any system that is not at or beyond the listed fixed versions as potentially vulnerable.
Patch to the correct fixed version (per Microsoft)
- Windows 10:
  - fixed in 10.0.17763.9121
  - fixed in 10.0.19044.7663
  - fixed in 10.0.19045.7663
  - (also listed) fixed in 10.0.17763.9115
- Windows 11:
  - fixed in 10.0.22631.7517
  - fixed in 10.0.26100.9168
  - fixed in 10.0.26200.9168
  - fixed in 10.0.28000.2704
  - (also listed) fixed in 10.0.26100.9106
- Windows Server 2019:
  - fixed in 10.0.17763.9121
- Windows Server 2022:
  - fixed in 10.0.20348.5499
- Windows Server 2025:
  - fixed in 10.0.26100.33296
Upgrade notes / breakage risk
- Use standard Microsoft update procedures for your Windows branch. If you have strict change-control windows, patch in the next maintenance window but prioritize systems with local-user access and Cloud Files usage.
Temporary workaround while patching
- Reduce the chance an untrusted local account exists on affected machines: remove unnecessary local users, reduce standing access, and follow least privilege.
- Limit which users can cause Cloud Files to process files/data in ways an attacker could abuse.
After patching
- Re-check build/update levels to confirm they match the fixed versions.
- Monitor for unusual local activity around file/cloud synchronization or Cloud Files processing after the change (look for unexpected account privilege changes or related security alerts).

Technical context

Severity is HIGH (CVSS 7.8) and the weakness is CWE-122 (heap-based buffer overflow). The attack requires an authenticated local user and no user interaction, consistent with a local privilege escalation pathway: triggering maliciously crafted data so the Windows Cloud Files Mini Filter Driver overflows heap memory, which can allow code execution with elevated privileges. In the provided findings, there is no KEV listing and no public exploit code on record; exploitation is not confirmed by dated press claims here. However, patch availability exists for all listed Windows variants, and security interest was noted (PULSE: Lazarus group). EPSS was predicted at 1.9% with a flat trend; this is a prediction and is not evidence of active exploitation by itself.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS24th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 24th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 5 days, from the signal feeds we watch.

2026-08-16Patch availablerecord updated
2026-08-13OpenVAS check addedpatch available, record updated
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 18 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable