Windows CCFFilter Driver CVE-2026-83780

Exploitation requires that the target run a supported Windows version whose CCFFilter driver build is below the patched level (e.g. Windows 10/Server 2019 build <10.0.17763.9376, Server 2016/Windows 10 1607 <10.0.14393.9612, Server 2022 <10.0.20348.5761, Server 2025 <10.0.26100.33650) and that the attacker can send traffic reaching the vulnerable CCFFilter driver code path. Per the CVSS vector (AV:N/PR:N/UI:N) exploitation is remote and unauthenticated with no user interaction. The chief limiting factors are the undocumented network reachability of this kernel filter driver (the specific protocol/service exposing it is not stated in the available data) and the fact that successful use-after-free exploitation in kernel space typically requires precise control over memory allocation timing even though SSVC rates the attack as automatable.

Signals are mixed and warrant careful prioritization. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) describes a textbook remote, unauthenticated, low-complexity RCE with total confidentiality, integrity and availability impact, and the SSVC framework reinforces the ceiling (Technical Impact: total, Automatable: yes). However, SSVC Exploitation is explicitly 'none', the CVE is NOT in CISA KEV, and no POC is referenced - so despite the critical score this is best classed as high-potential but not-yet-exploited. Exploitation status: no public exploit identified at time of analysis. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be factored in and should be checked separately. Note a tension worth verifying: the finding carries a 'Denial Of Service' tag and is a use-after-free (CWE-416) in a kernel-mode filter driver, yet is rated as full remote code execution with AV:N - kernel UAFs reachable purely over the network and reliably automatable are notable, so confirm the actual network-reachable trigger path with Microsoft's advisory. Overall: treat as a high patching priority because of total impact, ubiquitous platform and Automatable:yes, while recognizing there is currently no evidence of active or public exploitation.

A remote, unauthenticated attacker sends specially crafted network traffic that reaches a vulnerable code path in the Windows CCFFilter kernel driver, triggering a use-after-free that corrupts kernel memory and leads to arbitrary code execution in kernel context. No user interaction or credentials are required per the CVSS vector. No public exploit or POC is identified at the time of analysis, though SSVC rates the technical impact as total and the attack as automatable.