What is the CVSS score of EUVD-2026-44002?

EUVD-2026-44002 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Windows CLFS Driver are affected by EUVD-2026-44002?

A high-severity privilege escalation in Windows Common Log File System (CLFS) Driver affects clients and servers across your Windows infrastructure, allowing authenticated users to gain…. A patch is available.

How to fix or mitigate EUVD-2026-44002?

Within 24 hours, inventory all Windows systems across your infrastructure to identify scope of exposure. Within 7 days, deploy the Microsoft vendor patch to client and server systems according to your standard change management process, prioritizing critical infrastructure and systems requiring elevated trust. Complete patch deployment verification and implement enhanced local privilege escalation monitoring through your SIEM within 30 days.

Windows CLFS Driver EUVD-2026-44002

| CVE-2026-50697 HIGH

Information Exposure (CWE-200)

2026-07-14 microsoft

GHSA-92hv-9549-833x

Information Disclosure Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today AI

7.8 HIGH

Local authenticated low-priv user (AV:L/PR:L) exploits default-loaded kernel driver with no interaction (AC:L/UI:N); leaked kernel data chains to SYSTEM giving full C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:13 vuln.today

CVE Published

Jul 14, 2026 - 17:04 nvd

HIGH 7.8

DescriptionCVE.org

Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Common Log File System (CLFS) Driver allows an already-authenticated, low-privileged user to elevate to SYSTEM on a wide range of Windows client and server releases. Microsoft classifies the root cause as exposure of sensitive information (CWE-200), but the CVSS impact profile (C:H/I:H/A:H) reflects that the leaked kernel data enables full local privilege escalation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though CLFS has historically been a heavily exploited elevation-of-privilege target in Windows.

Technical ContextAI

The Common Log File System (clfs.sys) is a kernel-mode general-purpose logging subsystem built into Windows and used by many components and applications to create transactional log files. Because CLFS runs in the kernel and parses complex on-disk log (BLF) structures, flaws in it are directly reachable from user mode and yield kernel-level impact. This CVE is categorized as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning the driver discloses privileged kernel memory content to a lower-privileged context; that disclosed data (for example kernel pointers or token/heap state) can be used to defeat mitigations such as KASLR and drive a reliable privilege-escalation exploit. The affected code is the CLFS driver shipped across Windows 10 (1607 through 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025, including Server Core installations.

RemediationAI

Apply the Microsoft security update for your specific Windows SKU as the primary and definitive fix; Patch available per vendor advisory, with per-SKU fixed builds listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50697 (the exact fix version string was not included in this dataset and should be taken from that page). Prioritize deployment on multi-user, RDP/terminal, and internet-facing servers where an attacker who gains any low-privileged foothold could immediately escalate. Because the vulnerability lives in the always-loaded kernel CLFS driver, there is no supported feature toggle or configuration workaround - CLFS cannot simply be disabled - so patching is the only reliable control; compensating measures until patching is complete are limited to reducing local attacker footholds: enforce least privilege, restrict interactive/RDP logon rights, deploy EDR to detect suspicious CLFS BLF manipulation and token-swapping behavior, and apply application allow-listing to slow initial code execution. Note these controls reduce the probability of reaching the vulnerable code but do not remove the flaw.