Claude Code CVE-2026-35603

Exploitation requires a multi-user Windows system with ProgramData configured with default permissions (writable by non-administrative users), a local non-administrative attacker account, and critically, a victim user launching Claude Code after the malicious configuration is placed. The C:\ProgramData\ClaudeCode subdirectory must not already exist or must be writable by the attacker (true by default since parent directory is writable). The vulnerability does NOT affect single-user systems, Windows installations with hardened ProgramData permissions, or systems where no users launch Claude Code after the attack. The requirement for user interaction (UI:P: victim must launch the tool) and specific timing (attack window closes if Claude Code is not executed, or if administrators immediately repair permissions) significantly limits real-world exploitability compared to network-based or no-interaction attacks.

This is a moderate-severity local privilege escalation with real but limited practical impact. The CVSS score of 5.4 reflects the combination of high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) offset by local attack vector and requirement for user interaction. The attack is reliable (AC:L) but requires three specific conditions: (1) a multi-user Windows system, (2) a local non-administrative attacker account, and (3) a victim user launching Claude Code after the malicious file is placed. This is NOT a network exploitation path and cannot affect single-user machines or systems where Claude Code is not used. EPSS data is not provided, but the combination of low attack frequency (multi-user systems with Claude Code), user interaction requirement, and patch availability (version 2.1.75) suggests this poses lower real-world risk than the CVSS score alone indicates. However, on shared development or lab systems where Claude Code is widely used, the attack surface is material. No public exploit code or active exploitation is mentioned, further reducing immediacy.

On a shared Windows development machine, an attacker with a standard user account creates the C:\ProgramData\ClaudeCode directory and places a malicious managed-settings.json containing commands that run with the privileges of whoever launches Claude Code next. When a developer or colleague (potentially with higher privileges) launches Claude Code, the application automatically loads and executes the attacker's configuration, granting code execution in that user's context. This could be used to steal credentials, install backdoors, or access sensitive development assets.