Windows Container Isolation CVE-2026-97790

Exploitation requires the attacker to already hold local, authenticated access to a Windows system where the Container Isolation FS Filter Driver (unionfs.sys) is active - this driver backs Windows container isolation and the Windows Sandbox/app-container file virtualization layer. The attacker must be able to create or control a symbolic link, junction, or reparse point that unionfs.sys resolves during a file operation, causing access to be redirected to an attacker-chosen target (CWE-59). Limiting factors that reduce real-world risk: no remote vector (AV:L), prior low-level authentication is mandatory (PR:L), the impact is confined to integrity/tampering with no confidentiality or availability loss, scope is unchanged (S:U), and affected hosts must run vulnerable builds below the patched versions (e.g., Windows 11 24H2 <10.0.26100.9711, Server 2025 <10.0.26100.33650, Server 2022 <10.0.20348.5761).

This is a moderate-severity, local tampering flaw (CVSS 5.5) whose signals are consistent and point to LOW real-world urgency despite affecting a ubiquitous platform. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the attacker must already have local, authenticated access to the target host and gains only an integrity impact (I:H) with no confidentiality (C:N) or availability (A:N) effect - i.e., file/data tampering, not disclosure or code execution. CISA's SSVC framework reinforces low priority: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably mass-exploited), and Technical Impact=partial. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or likely near-term exploitation. The one notable conflict is the input Tag 'Information Disclosure,' which contradicts both the description ('tampering') and the CVSS vector (C:N, I:H) - this is an integrity/tampering issue, not information disclosure, and the tag should be treated as mislabeled. Bottom line: a real but low-priority local-privilege/integrity bug; patch in routine cycle rather than as an emergency, and do not let the ubiquitous Windows footprint inflate the perceived urgency since exploitation requires pre-existing local access.

An attacker who already has a low-privileged authenticated session on a Windows host abuses a symbolic link / junction (CWE-59) handled by the Container Isolation FS filter driver (unionfs.sys) so that a file operation is redirected to a location the attacker should not be able to modify, tampering with its contents or integrity. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means exploitation is reliable once local access is obtained, though no user interaction or remote reach is involved.