Privilege Escalation in Microsoft Windows Cloud Files Mini Filter Driver (CVE‑2023‑36036)
What It Is — The Cloud Files Mini Filter driver in Microsoft Windows contains a privilege‑escalation flaw that can allow a low‑privileged user to obtain SYSTEM privileges. The issue stems from improper handling of object references in the driver code.
Exploitability — Publicly disclosed in the CISA Known Exploited Vulnerabilities list; proof‑of‑concept code is available, and active exploitation is reported. CVSS v3.1 base score 7.8 (High).
Affected Products — Microsoft Windows 10, Windows Server 2016, Windows Server 2019, and Windows Server 2022 (all versions that include the Cloud Files mini‑filter driver).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous patch management as a core control for maintaining a defensible security posture.
- Highlights the importance of evidence‑driven remediation tracking to satisfy audit requirements across frameworks.
- Reinforces that privileged‑access controls must be verified after each update to ensure no residual escalation paths remain.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2023‑36036 immediately via Windows Update or WSUS.
- Verify remediation on all endpoints using a trusted configuration‑management tool and retain logs as audit evidence.
- Update your control‑mapping to reflect the patched state and document the change in your Trust Center repository.
Source: CISA KEV – CVE‑2023‑36036