CVE-2026-80093

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 23rd percentile. A vendor fix is available.

CVSS 3.17.0High EPSS percentile23rd0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-08Updated 2026-09-10Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which systems run Windows 10, Windows 11, or Windows Server 2019/2022/2025 and confirm whether they are updated past the fixed build listed below.
For Windows 10, update to 10.0.17763.9245 or 10.0.19044.7725 or 10.0.19045.7725.
For Windows 11, update to 10.0.22631.7582 or 10.0.26100.9445 or 10.0.26200.9445 or 10.0.28000.2954.
For Windows Server 2019, update to 10.0.17763.9245; for Windows Server 2022, update to 10.0.20348.5622; for Windows Server 2025, update to 10.0.26100.33438.
If you can’t patch immediately, isolate affected machines from the network and limit who can log on locally, then patch as soon as possible.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-80093 is a Windows security flaw that can let a locally logged-in attacker gain higher privileges; most small businesses should treat it as serious and patch it if these Windows versions are in use.

CVE-2026-80093 is a local elevation of privilege issue caused by a use-after-free condition in the Windows Cloud Files Mini Filter Driver, where an authorized local attacker can trigger the weakness to run with higher privileges.

If you're affected

Local privilege escalation
Potential full system compromise
Account takeover risk
Operational disruption from remediation

What is it

This is a Windows bug in a built-in file-handling component (the Cloud Files “mini filter driver”). If someone already has the ability to log in locally (an authorized local attacker), they may be able to exploit the bug to gain higher permissions on the machine—like turning a regular employee account into an administrator account.

Who is affected

This matters if you run Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025. The danger is primarily for situations where an attacker already has local access (for example, they can log in to a user account). Because there is no public exploit code listed and KEV is not indicated, it’s still important to patch—especially on machines that are exposed to risk of local access.

How urgent is it

This is a RED (high urgency) patch item because it can enable local privilege escalation, which can quickly turn a foothold into full control of the affected Windows system. While no public exploit code is known and KEV is not listed, the issue targets a sensitive privilege boundary in a core Windows component, so delaying increases the window for local attackers.

What to do — in detail

Identify affected systems: inventory all endpoints and servers running Windows 10/11 and Windows Server 2019/2022/2025.
Determine current build numbers: on each machine, check the OS build (the “version/build” shown in system settings or via standard admin tooling) and compare to the fixed versions below.
Patch to the fixed builds (do not rely on partial updates):
- Windows 10: fixed in 10.0.17763.9245, 10.0.19044.7725, 10.0.19045.7725
- Windows 11: fixed in 10.0.22631.7582, 10.0.26100.9445, 10.0.26200.9445, 10.0.28000.2954
- Windows Server 2019: fixed in 10.0.17763.9245
- Windows Server 2022: fixed in 10.0.20348.5622
- Windows Server 2025: fixed in 10.0.26100.33438
Follow Microsoft’s update guidance: use the vendor remediation page for the correct update packages and rollout sequencing (link provided below in the IT message).
If patching is delayed (workaround): restrict local logons as much as practical (remove unnecessary local admin rights), and reduce exposure by isolating high-risk machines from the broader network until updates are installed.
Validate: after reboot/update, re-check the build number to confirm it is at or above the fixed version for your OS.
Monitor: watch for unusual privilege changes and local admin activity around the time of any suspected access; review relevant security logs on endpoints where local access is possible.

Technical context

Severity is reported as HIGH (CVSS 7). This vulnerability is a use-after-free (CWE-416) in the Windows Cloud Files Mini Filter Driver. The reported impact is local elevation of privilege where an authorized local attacker can trigger the bug to gain higher privileges.

Findings summary: there is no KEV listing for this CVE and no public exploit code on record. Reported EPSS is a low predicted likelihood and flat trend, but it is not used here to downgrade urgency because this is an elevation-of-privilege class issue and your required remediation should follow the vendor patch guidance.

Mitigation is to apply the vendor-provided fixes to reach the fixed build numbers listed in the patch section.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS23rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 23rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 2 days, from the signal feeds we watch.

2026-09-10OpenVAS check addedpatch available, record updated
2026-09-09Record updatedrecord updated
2026-09-08Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 18 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.0 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable