What is the CVSS score of CVE-2026-58637?

CVE-2026-58637 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows CSC Service are affected by CVE-2026-58637?

A privilege escalation vulnerability in Windows Client-Side Caching Service affecting Windows 10, 11, and Server 2012-2025 allows low-privilege users to gain SYSTEM access, creating risk for lateral…. A patch is available.

How to fix or mitigate CVE-2026-58637?

Within 24 hours, inventory all Windows 10 (builds 1607-22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server (2012-2025) systems to identify exposure; coordinate with infrastructure teams and prioritize high-value targets (domain controllers, sensitive data repositories). Within 7 days, develop a phased patch deployment plan, test the patch on representative systems in non-production environments, and brief security and operations leadership on rollout sequencing. Within 30 days, complete patch application across all affected systems, prioritizing critical infrastructure first, and verify remediation through vulnerability scans.

Windows CSC Service CVE-2026-58637

EUVD-2026-44314 HIGH

Use After Free (CWE-416)

2026-07-14 microsoft

GHSA-6q58-22x4-6rcv

Denial Of Service Use After Free Memory Corruption Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local-only UAF in a privileged service requires an authenticated low-priv account (PR:L) and a race win (AC:H); success yields full local C/I/A compromise.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:42 vuln.today

CVE Published

Jul 14, 2026 - 17:10 nvd

HIGH 7.0

DescriptionCVE.org

Use after free in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Microsoft Windows Client-Side Caching (CSC) Service, driven by a use-after-free (CWE-416) memory-corruption flaw affecting Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. An authorized attacker who already holds low-level privileges (PR:L) on the host can trigger the freed-object reuse to gain elevated, likely SYSTEM-level, privileges. The issue was reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

The Client-Side Caching (CSC) Service underpins Windows Offline Files, caching network share (SMB) content locally so users can access it when disconnected; it runs as a privileged system component (cscsvc). The root cause is a use-after-free (CWE-416): the service continues to reference a heap object after it has been freed, allowing the freed memory to be reallocated and controlled by an attacker before the dangling pointer is dereferenced. Successful control of that reused allocation lets attacker-influenced data be treated as a valid object, yielding code execution in the service's security context. The CPE data confirms the affected surface is the operating system itself across a broad range of client and server SKUs (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations).

RemediationAI

Apply the Microsoft security update for CVE-2026-58637 (Patch available per vendor advisory) for each affected SKU via Windows Update / WSUS / your patch-management tooling; the authoritative fix and per-SKU KB numbers are published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58637. Because exact fixed build/KB versions were not included in this dataset, pull them from that MSRC page rather than assuming a version. As a compensating control where patching must be delayed and Offline Files is not required, disable the Offline Files / CSC feature (via Group Policy 'Allow or Disallow use of the Offline Files feature' or Sync Center), which removes the vulnerable service's exposure at the cost of losing offline access to network shares for roaming or intermittently-connected users. Since exploitation requires an authenticated local foothold (PR:L), also tighten local access - limit interactive/low-privilege logon rights on servers and enforce least privilege on endpoints - to reduce the pool of principals who could trigger the flaw.