EUVD-2026-56659
GHSA-ccg4-hhwp-8337
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local low-privileged access required to reach the FS filter driver; only confidentiality is impacted as the authorization bypass permits reads but no data modification or service disruption.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information locally.
AnalysisAI
Incorrect authorization in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows a local authenticated attacker on Windows 11 26H1 to disclose sensitive information beyond their authorized filesystem scope. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact confined to the local system, with no integrity or availability consequence. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local authenticated account with at least low privileges (PR:L per CVSS) on a Windows 11 26H1 system where the Windows Container Isolation FS Filter Driver (unionfs.sys) is loaded and active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate and context-dependent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch to reach build 10.0.28000.2704 or later on Windows 11 26H1 systems via Windows Update or WSUS; the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62775 provides patch deployment guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Windows 11 26h1
View allPrivilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Remote code execution in Microsoft Windows HTTP.sys allows unauthenticated network attackers to execute arbitrary code b
Privilege elevation in the Windows TCP/IP networking stack allows an unauthenticated attacker on an adjacent network to
Remote code execution in Windows RRAS affects Windows 10 1607 and Windows Server 2022 23h2 through an integer overflow v
Local code execution in Microsoft Windows Win32K GRFX (graphics) subsystem allows an attacker with low-privilege local a
Local code execution in the Windows Win32K GRFX (graphics) subsystem allows an unauthorized attacker with the ability to
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Windows Push Notifications enables an authenticated low-privileged user to elevate to high
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) in conc
Remote denial-of-service in Microsoft's HTTP/2 implementation allows unauthenticated network attackers to exhaust server
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today