EUVD-2026-56659
GHSA-ccg4-hhwp-8337
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local low-privileged access required to reach the FS filter driver; only confidentiality is impacted as the authorization bypass permits reads but no data modification or service disruption.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information locally.
AnalysisAI
Incorrect authorization in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows a local authenticated attacker on Windows 11 26H1 to disclose sensitive information beyond their authorized filesystem scope. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact confined to the local system, with no integrity or availability consequence. No public exploit code exists and SSVC rates exploitation as none, placing this as a routine patching priority rather than an emergency response item.
Technical ContextAI
The vulnerability resides in unionfs.sys, the kernel-mode FS filter driver that implements Windows Container Isolation - a technology providing filesystem namespace separation for Windows container workloads (e.g., Docker on Windows, Windows Sandbox). CWE-863 (Incorrect Authorization) indicates the driver performs an authorization check but applies it incorrectly, allowing a caller with low privileges to access filesystem resources outside their authorized namespace boundary. The CVSS scope metric (S:U) suggests the disclosure is bounded to the local system rather than enabling cross-system lateral movement. Affected builds are Windows 11 version 26H1, specifically 10.0.28000.0 up to (but not including) 10.0.28000.2704, as confirmed by EUVD-2026-56659.
RemediationAI
Apply the vendor-released patch to reach build 10.0.28000.2704 or later on Windows 11 26H1 systems via Windows Update or WSUS; the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62775 provides patch deployment guidance. Prior to patching, restrict local logon and container execution rights to only explicitly trusted service accounts, reducing the pool of principals who could reach the vulnerable driver. On systems where Windows Container Isolation is not operationally required, disabling the feature or unloading the unionfs.sys driver eliminates the attack surface entirely, though this will break any dependent container workloads. No workaround eliminates the underlying authorization flaw without patch application.
More in Windows 11 26h1
View allSymlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Remote code execution in Microsoft Windows HTTP.sys allows unauthenticated network attackers to execute arbitrary code b
Privilege elevation in the Windows TCP/IP networking stack allows an unauthenticated attacker on an adjacent network to
Remote code execution in Windows RRAS affects Windows 10 1607 and Windows Server 2022 23h2 through an integer overflow v
Local code execution in Microsoft Windows Win32K GRFX (graphics) subsystem allows an attacker with low-privilege local a
Local code execution in the Windows Win32K GRFX (graphics) subsystem allows an unauthorized attacker with the ability to
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Windows Push Notifications enables an authenticated low-privileged user to elevate to high
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) in conc
Remote denial-of-service in Microsoft's HTTP/2 implementation allows unauthenticated network attackers to exhaust server
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today