Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to manipulate encoded output, enabling content or identity spoofing with high integrity impact. Affected products span three active .NET generations plus Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7), creating a broad enterprise attack surface. A publicly available proof-of-concept exploit exists on GitHub; however, CISA SSVC reports exploitation status as none and EPSS sits at 0.41% (34th percentile), suggesting opportunistic rather than widespread active threat activity at time of analysis.
External file path control in Microsoft SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition allows authenticated low-privileged network attackers to perform spoofing, resulting in high confidentiality impact (C:H per CVSS). Exploitation requires no special configuration or user interaction, only a valid SharePoint account. No active exploitation is confirmed - SSVC rates exploitation as none, EPSS sits at 0.71% (49th percentile), and this CVE does not appear in CISA KEV - placing this as a medium-priority patching item despite its network-reachable, low-complexity attack profile.
Server-side request forgery in Microsoft SharePoint Server enables authenticated, low-privileged users to force the server to issue outbound network requests, exposing internal resources and sensitive data not directly accessible to the attacker. All three actively supported SharePoint server editions are affected: Enterprise Server 2016, Server 2019, and Subscription Edition. No public exploit code or CISA KEV listing exists at time of analysis; EPSS sits at 0.59% (44th percentile) and SSVC rates exploitation as none, indicating limited real-world exploitation activity despite the medium-high CVSS score.
jackson-databind's @JsonView authorization guard is bypassable on deserialization when a property carries both @JsonView and @JsonUnwrapped annotations, allowing an authenticated or unauthenticated attacker to mass-assign privileged fields through a less-privileged active view. Affected are com.fasterxml.jackson.core:jackson-databind 2.18.0-2.18.8, 2.21.0-2.21.4, 2.22.0, and tools.jackson.core:jackson-databind 3.0.0-3.1.4, 3.2.0. A publicly available proof-of-concept demonstrates the bypass; SSVC reports no confirmed active exploitation at time of analysis, and EPSS sits at 0.42% (34th percentile), indicating low current threat velocity despite the high-integrity impact.
Security feature bypass in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks plugin allows a high-privileged, authenticated attacker to defeat an authorization check (CWE-863) and gain unauthorized read access to data that should be restricted. The flaw is network-reachable with low complexity, requires no user interaction, and changes scope, so the exposure can reach beyond the initially vulnerable component. There is no public exploit identified at time of analysis and no CISA KEV listing, making exploitation currently theoretical rather than observed.
Account takeover in the WP 2FA WordPress plugin (all versions before 3.1.1.2) is achievable by any attacker who has obtained a valid user's credentials. The plugin fails to verify that the email address submitted during two-factor authentication enrollment belongs to the authenticated account (CWE-862: Missing Authorization), allowing the attacker to redirect the setup verification code to an attacker-controlled inbox and complete 2FA enrollment on behalf of the victim. A publicly available proof-of-concept exists per WPScan; this vulnerability is not currently listed in the CISA KEV catalog, but the combination of a PoC, medium-prevalence deployment, and account-takeover impact warrants prompt patching.
Server-side request forgery in Sustainable Irrigation Platform (SIP) through version 5.2.16 allows unauthenticated network attackers to weaponize the device as an HTTP proxy against internal or external hosts. Exploitation requires the optional Node-RED plugin to be installed and leverages the known default passphrase 'opendoor' to bypass authentication to the plugin interface - dramatically lowering the practical barrier for blind SSRF. A publicly available proof-of-concept exploit exists per ZeroScience advisory ZSL-2026-5998; no CISA KEV listing at time of analysis.
SureForms WordPress plugin before 2.11.1 permits unauthenticated attackers to submit manipulated payment amounts below the configured price on any form using a dynamically-sourced or hidden variable payment field, enabling financial fraud against site operators. The integrity bypass is confined to forms with variable pricing; fixed-price forms are explicitly unaffected. A publicly available proof-of-concept exists via WPScan, and a vendor patch is available in version 2.11.1 - though no CISA KEV listing confirms active mass exploitation at time of analysis.
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a maliciously crafted document, exposing potentially sensitive memory contents with high confidentiality impact (C:H). The vulnerability spans a broad range of Microsoft Office and SharePoint products - including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Word 2016, Office 2019, Office 365 for Mac, and multiple SharePoint Server versions. No public exploit identified at time of analysis; CISA SSVC rates exploitation as none, EPSS stands at 0.39% (31st percentile), and a vendor-released patch is available from Microsoft.
Information disclosure in Microsoft Office Word and related Microsoft 365/SharePoint products exposes sensitive memory contents when a user opens a specially crafted document. Affecting a broad suite of products spanning Word 2016 through Office LTSC 2024 and SharePoint Server versions, the flaw stems from improper input type validation (CWE-1287) in the document parsing subsystem. No public exploit has been identified at time of analysis; EPSS at 0.39% and CISA SSVC exploitation status of 'none' confirm this remains a theoretical rather than actively targeted risk, though Microsoft has released patches.
Out-of-bounds read in Microsoft Office Word and associated Microsoft 365 products allows local information disclosure when a user opens a specially crafted document. Affecting a broad range of Microsoft Office versions across Windows and macOS - including Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and SharePoint Server 2016/2019/Subscription Edition - an attacker with no prior system privileges must socially engineer a victim into opening a malicious file to trigger memory disclosure. No public exploit identified at time of analysis; EPSS is 0.39% (31st percentile) and SSVC confirms exploitation status as none and the attack as non-automatable.
SQL injection in SourceCodester Simple and Nice Shopping Cart Script 1.0 enables remote attackers to manipulate backend database queries via the unsanitized `user_id` parameter in `/admin/userproductdeletequery.php`. A publicly available proof-of-concept exploit exists on GitHub, and SSVC confirms the attack is automatable with partial impact across confidentiality, integrity, and availability. Despite the public POC, EPSS stands at only 0.33% (25th percentile), reflecting the product's negligible enterprise deployment footprint rather than a benign technical profile.
Unrestricted file upload in code-projects Online Job Portal 1.0 exposes unauthenticated remote attackers to arbitrary file upload via the txtFile parameter in /JobSeekerInsert.php, enabling likely webshell deployment and subsequent server-side code execution. A public proof-of-concept exploit exists (no KEV listing), substantially lowering the exploitation barrier for any internet-exposed instance. The CVSS 4.0 impact metrics are conservatively rated Low across C/I/A, which understates the realistic post-exploitation potential of an unrestricted PHP file upload - successful webshell placement typically yields full OS command execution in the web server process context.
SQL injection in code-projects Online Job Portal 1.0 exposes the /Admin/DeleteUser.php endpoint to unauthenticated remote database manipulation. An attacker can craft HTTP requests that inject arbitrary SQL, enabling data extraction, modification, or deletion from the underlying database. A public proof-of-concept exploit exists (GitHub: shihuizhang-dazhi/MY-CVE/issues/4), lowering the bar for exploitation; this vulnerability is not currently listed in CISA KEV.
SQL injection in code-projects Online Job Portal 1.0 exposes the /Admin/EditUser.php endpoint to remote database manipulation via the unsanitized UserId parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) classifies this as remotely exploitable with no authentication or interaction required, though the Admin path location raises questions about actual auth gating in practice. A public exploit exists (E:P confirmed in CVSS 4.0 and via GitHub issue), lowering the skill bar for exploitation considerably; this CVE is not currently listed in CISA KEV.
Unauthenticated authorization bypass in poco-ai/poco-claw's Workspace API allows remote attackers to access arbitrary users' workspace files by manipulating the user_id parameter in the get_workspace_file function. All versions through 0.5.4 are affected, with the executor manager's control-plane routes completely lacking token-based authentication before the fix. Publicly available exploit code exists (POC confirmed via GitHub issue #133 and PR #135); no CISA KEV listing at time of analysis.
Stored/reflected cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition) lets an authenticated attacker inject script that executes in another user's browser session to spoof content over the network. Although Microsoft classifies the impact as 'spoofing,' the CVSS 3.1 vector rates confidentiality and integrity as High (C:H/I:H), indicating the injected script can access or alter sensitive session data. There is no public exploit identified at time of analysis, and a vendor patch is available.
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated network attacker to inject malicious scripts into SharePoint pages, causing spoofing against users who view the affected content. The vulnerability carries a CVSS 5.4 (Medium) score with an EPSS of 0.38% (30th percentile), indicating low current exploitation probability. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; a vendor-released patch is available via the Microsoft Security Response Center.
Cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition) allows an authenticated attacker with low-privilege access to inject malicious JavaScript into SharePoint-rendered pages, which then executes in the browsers of other users who view the content, enabling spoofing and session-context abuse. The CVSS PR:L requirement confirms unauthenticated exploitation is not possible, and the UI:R requirement means the attack depends on victim interaction. No public exploit code has been identified, SSVC rates exploitation as none with partial technical impact, and the EPSS score of 0.38% (30th percentile) indicates low near-term exploitation probability.
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition enables authenticated network attackers to inject malicious scripts that execute in victims' browsers, enabling spoofing, session hijacking, or unauthorized actions on behalf of targeted users. The CWE-79 flaw requires victim interaction (UI:R) and low-privilege attacker credentials (PR:L), but the changed scope (S:C) means impact extends beyond the SharePoint server into the victim's browser session. No public exploit identified at time of analysis; EPSS of 0.28% (20th percentile) and SSVC exploitation rating of 'none' indicate low immediate threat despite broad enterprise deployment.
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated attacker with low-privilege network access to inject malicious scripts into SharePoint pages, resulting in spoofing impacts when a victim user interacts with the crafted content. The CVSS vector (PR:L/UI:R) confirms exploitation requires both an existing authenticated account and victim interaction, constraining real-world risk relative to unauthenticated XSS variants. No public exploit identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog. Vendor patch is available via the Microsoft Security Response Center.
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition enables an authenticated attacker to inject malicious scripts into SharePoint-generated web pages viewed by other users, producing a spoofing effect. The scope-changed CVSS vector (S:C) confirms that impact escapes the server component and reaches victim browsers. No active exploitation is confirmed - EPSS sits at 0.28% (20th percentile) and CISA has not added this to KEV - placing real-world urgency below the raw CVSS 5.4 might suggest.
Spoofing vulnerability in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition allows an authenticated network attacker to impersonate identities or forge content due to improper access control (CWE-284). Exploitation requires valid credentials (CVSS PR:L), limiting opportunistic attack surface. SSVC assessment confirms no active exploitation, and EPSS sits at just 0.28% (20th percentile), consistent with a targeted rather than broadly exploited vulnerability. Vendor-released patches are available for all three affected product lines.
OnionShare's Receive mode incorrectly writes uploaded files to disk even when the operator has explicitly disabled file uploads, allowing unauthenticated remote attackers over Tor to bypass the access-control setting and deposit files on the host system. This affects deployments where operators have configured the 'disable uploads' option with an expectation that no inbound file writes will occur. No public exploit code or CISA KEV listing is identified at time of analysis, but the logic bypass is straightforward and exploitable against any exposed OnionShare Receive-mode instance with uploads disabled.
Authenticated operator access in nebula-mesh v0.3.0-v0.3.8 allows bypassing the configured enrollment token lifetime policy: the Web UI host-creation path (POST /ui/hosts) hardcodes a 24-hour bearer token expiry in internal/web/handlers.go:879, silently ignoring both server-wide and per-network enrollment_token_ttl settings that the API sibling path (internal/api/hosts.go:190-196) correctly honors via the tokenTTLFor resolver. Enrollment tokens are bearer credentials for the public POST /api/v1/enroll endpoint; a token with a longer-than-intended TTL widens the window in which a copied, logged, or leaked token can enroll a pending Nebula host and retrieve its signed certificate and configuration. Publicly available exploit code (a reproducible Go unit test) confirms the bypass on v0.3.8; no public exploit identified at time of analysis beyond this PoC; a vendor-released patch exists in v0.5.0.
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin (all versions before 4.7.1) enables users with administrator-level access to plant persistent malicious scripts via the BEAF Slider widget's shortcode field, which then execute silently in the browsers of any site visitor loading a page displaying the widget. The plugin pipes the field value through WordPress's native do_shortcode() function without sanitizing or escaping the output, causing unrecognized content to be echoed verbatim to the rendered page. A publicly available proof-of-concept has been disclosed by WPScan; no active exploitation has been confirmed in the CISA Known Exploited Vulnerabilities catalog.
Unbounded in-memory state growth in nebula-mesh's OIDC login endpoint allows unauthenticated remote clients to cause availability degradation by flooding GET /ui/oidc/login, which allocates a new server-side state entry per request for a 10-minute TTL with no rate limit and no maximum live-state cap. Affected versions span v0.2.0 through v0.3.8; the attack requires only that OIDC be enabled and requires no credentials, IdP interaction, or user involvement. A publicly available PoC demonstrates 1,000 requests producing 1,000 live state entries with zero 429 responses; no public exploit identified at time of analysis as actively exploited (not in CISA KEV), though the low-barrier PoC meaningfully reduces the effort required.
Stored cross-site scripting in Sustainable Irrigation Platform (SIP) through version 5.2.16 enables unauthenticated remote attackers to permanently inject arbitrary JavaScript by submitting crafted program names via HTTP requests, with the payload executing in every subsequent viewer's browser. Exploitation is significantly facilitated by the application's acceptance of submissions with no passphrase configured or using the default passphrase 'opendoor', removing any authentication barrier in common deployments. A publicly available proof-of-concept exploit from ZeroScience (ZSL-2026-5994) documents the attack path; this CVE is not currently listed in the CISA KEV catalog.
OnionShare fails to restrict symlink traversal within shared directories, allowing any recipient of a file share to read arbitrary local files on the sharer's machine. When a user shares a directory containing symbolic links, OnionShare follows those links and serves the linked files over the Tor .onion URL - including files and directories outside the intended share root. This is an information-disclosure vulnerability affecting users of OnionShare who share directories that contain symlinks, whether knowingly or not. No public exploit code or active exploitation has been identified at time of analysis, and the issue was reported through Ubuntu's vendor security channel.
BitLocker encryption bypass on Windows enables an unauthenticated attacker with physical access to circumvent drive-level encryption protections and read confidential data from protected volumes. Affected platforms span Windows 10 (versions 1607 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2016 through 2025, with a publicly available proof-of-concept exploit on GitHub lowering the bar for physical-access adversaries. No active exploitation is confirmed (not in CISA KEV; SSVC exploitation status: none), and EPSS sits at 0.38% (30th percentile), consistent with a targeted rather than opportunistic threat; Microsoft has released patches across all affected build lines.
Remote denial-of-service in Rockwell Automation's 1734 POINT I/O module allows unauthenticated network attackers to force the module into a faulted state by sending specially crafted CIP (Common Industrial Protocol) messages, halting I/O processing until a manual restart is performed. The CVSS 4.0 base score of 8.7 reflects a high availability impact against a network-reachable OT device with no privileges or user interaction required. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Type confusion (CWE-843) in Microsoft SQL Server 2025 enables authenticated, low-privileged network attackers to disclose sensitive server-side information. The CVSS vector (AV:N/PR:L/C:H) confirms that any authorized database user - regardless of their data access permissions - can potentially trigger the flaw remotely with no user interaction required. No public exploit code or CISA KEV listing exists at time of analysis, but the high confidentiality impact and low access complexity make patching a meaningful priority for organizations running SQL Server 2025.
Buffer over-read in Microsoft SQL Server 2025 exposes server memory contents to low-privileged authenticated attackers over the network, resulting in high confidentiality impact with no integrity or availability consequences. Both the Cumulative Update 6 (CU 6) and General Distribution Release (GDR) servicing tracks on x64-based systems are confirmed affected per vendor CPE data. No public exploit has been identified and CISA has not listed this in KEV; SSVC assessment corroborates no active exploitation at time of analysis, placing this in a measured but real priority category for environments handling sensitive SQL data.
Improper authentication in Windows Admin Center (versions prior to 2.6.5.16) enables an authenticated low-privilege attacker over a network to bypass authentication controls and access sensitive information beyond their authorized scope. The flaw is classified as CWE-287 (Improper Authentication) and affects all Windows Admin Center 1809.0 installations below the patched release. No public exploit code has been identified and CISA has not listed this in KEV, indicating no confirmed active exploitation at the time of analysis.
Credential disclosure in Visual Studio Code (including GitHub Copilot integration) exposes user credentials to network-positioned attackers across all versions prior to 1.128.1. Rooted in CWE-522 (Insufficiently Protected Credentials), the flaw enables a remote unauthenticated attacker to capture credentials when a user performs a triggering action, potentially granting access to GitHub or Microsoft services. No active exploitation is confirmed (SSVC: Exploitation none; not in CISA KEV), and the EPSS score of 0.60% reflects low observed exploitation probability at time of analysis.
Privilege escalation in Microsoft Azure CycleCloud allows a network-authenticated low-privileged attacker to elevate their access level by exploiting a missing authorization check (CWE-862). All Azure CycleCloud versions from 1.0.0 up to 8.9.1 are affected, with version 8.9.1 serving as the patched release. Publicly available exploit code exists per SSVC assessment, though EPSS probability remains low at 0.37% (29th percentile), suggesting limited but non-zero exploitation interest.
Path traversal in Rockwell Automation's Studio 5000 Logix Designer allows an attacker who can deliver a crafted ACD project file to write arbitrary files to attacker-controlled locations on an engineer's workstation. The software fails to sanitize or validate embedded filenames during the ACD project-open procedure, enabling path traversal sequences to escape the intended extraction directory and potentially achieve code execution. No public exploit code or CISA KEV listing has been identified at time of analysis, but the ICS context makes targeted file-delivery attacks via spear-phishing or shared project repositories a realistic threat vector.
Cross-site scripting in Microsoft Visual Studio Code lets an attacker who tricks a local user into opening crafted content bypass a built-in security feature and gain high-impact code execution within the editor context. The flaw (CWE-79) carries a CVSS 3.1 base score of 7.1 with a local attack vector requiring user interaction, and Microsoft has published an advisory with a fix. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows a high-privileged attacker to inject persistent malicious JavaScript into vulnerable admin form fields, which then executes in any victim's browser that navigates to the affected page. Scope change (S:C) is confirmed in the CVSS vector, meaning the injected payload crosses from the Commerce application security boundary into the victim's browser session, enabling session hijacking or credential harvesting. Despite no current KEV listing, the EPSS score sits at the 96th percentile (11.52%), warranting close monitoring even though CISA SSVC currently rates exploitation as none and the attack is not assessed as automatable.
The reschedule endpoint in Easy!Appointments 1.5.2 and earlier exposes the complete customer database record to any party holding the 12-character appointment hash, with no authentication check and no field whitelisting on the ea_users row. These hashes are deliberately distributed to customers in reschedule emails, embedded in confirmation page URLs, and visible in operator calendar links, which means the effective attacker pool is anyone who has ever received or forwarded a booking email. The fix is available in version 1.6.0 per the GitHub security advisory; no public exploit code and no CISA KEV listing have been identified at time of analysis.
HTTP/1.1 trailer leakage in Eclipse Jetty allows a remote unauthenticated attacker to read trailer headers from a previous request when sharing a persistent connection with another party. Trailers sent in an initial request are incorrectly retained in the server's connection state, causing them to bleed into all subsequent requests on the same keep-alive connection - either appended wholesale (if the later request has no trailers) or merged with the later request's own trailers. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Hidden ticket purchase bypass in Hi.Events through v1.10.0-beta allows unauthenticated remote attackers to acquire VIP, invite-only, or discounted tickets withheld from public sale by referencing hidden ticket and price IDs directly in order creation API requests. The server fails to enforce ticket visibility rules at the API layer, relying only on UI-level concealment, and sequential integer ticket IDs allow systematic enumeration from observed visible IDs. No public exploit or active exploitation (KEV) has been identified at time of analysis, but the unauthenticated network vector and low complexity make opportunistic exploitation straightforward following disclosure.
Heap-based buffer overflow in the Windows Resilient File System (ReFS) driver enables an unauthorized attacker with physical access to the target machine to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The vulnerability spans a wide range of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. No public exploit or active exploitation has been identified (SSVC: Exploitation none), and Microsoft has released patches; however, the physical attack vector (AV:P) is the dominant risk-shaping factor.
Remote code execution in the Windows DNS Server component allows an authorized, high-privileged attacker on an adjacent network to traverse outside intended directory boundaries and execute arbitrary code on the target host. Affected platforms span Windows Server 2012 through Server 2025 and Windows 10 versions 1607 and 1809. No public exploit code exists and no active exploitation has been confirmed - CISA SSVC classifies exploitation as 'none' and EPSS sits at 0.37% (29th percentile) - however SSVC rates technical impact as 'total', consistent with the full C:H/I:H/A:H CVSS triad.
Privilege escalation to SYSTEM level is achievable in Windows Spaceport.sys - the kernel-mode Storage Spaces port driver - across a wide range of Windows 10, Windows 11, and Windows Server releases, when an attacker has physical access to the target machine. An integer overflow or wraparound in the driver's arithmetic logic (CWE-190) can corrupt kernel memory structures, enabling full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and SSVC confirms exploitation status as none, but the Technical Impact rating is total, meaning successful exploitation fully compromises the affected system.
Integer overflow in Windows Storage Spaces Direct enables an unauthenticated attacker with physical access to execute arbitrary code on affected Windows client and server platforms. The CVSS vector (AV:P/AC:L/PR:N/UI:N, C:H/I:H/A:H) confirms that no credentials are required but direct physical presence at the target hardware is mandatory, substantially narrowing the realistic attacker pool. No public exploit identified at time of analysis; SSVC rates exploitation as 'none' and EPSS stands at 0.33% (26th percentile), consistent with a physical-vector vulnerability not currently observed in opportunistic campaigns.
Heap-based buffer overflow in the Windows Kernel (CWE-122) enables an unauthenticated attacker with physical access to escalate privileges to SYSTEM level across a broad range of Windows 10, Windows 11, and Windows Server editions. The physical attack vector (AV:P) constrains the threat surface significantly, and SSVC rates exploitation as none with no public exploit identified at time of analysis. Despite total technical impact potential confirmed by both CVSS C:H/I:H/A:H metrics and SSVC technical impact rating, real-world risk is concentrated in physically accessible deployment scenarios such as kiosks, field laptops, or shared terminals.
Privilege escalation via heap-based buffer overflow in the Windows NTFS filesystem driver affects a broad range of Windows 10, Windows 11, and Windows Server versions, requiring only physical access to the target device - no OS credentials needed. An attacker with hands-on access to the hardware can trigger a heap overflow in NTFS processing to gain elevated privileges, potentially achieving full system compromise (High C/I/A). No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the combination of zero authentication requirements and critical-level impact makes it a realistic threat for physically accessible endpoints. A vendor-supplied patch is available via the Microsoft Security Response Center.
Privilege escalation to full system control is achievable in Windows Storage Spaces Direct via a CWE-190 integer overflow that causes arithmetic wraparound, exploitable by an attacker with physical access to affected hardware. The flaw spans Windows 10 (versions 1607-22H2), Windows 11 (24H2-26H1), and Windows Server 2016 through 2025, representing a broad Microsoft platform footprint. Despite the C:H/I:H/A:H impact profile confirmed by SSVC as 'technical impact: total,' the physical access prerequisite (AV:P) is a hard constraint; SSVC additionally confirms exploitation status as none, no public exploit code exists, and EPSS sits at 0.31% (23rd percentile), making this a low operational priority for most organizations.
Privilege escalation via physical attack in the Windows Cloud Files Mini Filter Driver (cldflt.sys) affects all major Windows 10, Windows 11, and Windows Server releases through 2025. The use-after-free memory corruption flaw (CWE-416) in the kernel-mode driver allows an attacker with physical access to the device to escalate privileges to SYSTEM level, achieving full confidentiality, integrity, and availability compromise. No public exploit code has been identified and CISA has not listed this in KEV, but the SSVC assessment notes total technical impact - the physical access requirement is the primary limiting factor, not the vulnerability's severity once that barrier is cleared.