VulnSocial

CVE-2026-58536Active Exploitation(microsoft / windows_10_1809)

MEDIUMCVSS 7.8 · HIGH

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

  • Patch microsoft windows_10_1809 systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

microsoft CVEsBack to dashboard
4.5/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-416

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • windows_10_1809
  • windows_10_21h2
  • windows_10_22h2
  • windows_11_24h2

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 1 signal
  • 2 total mentions across 1 day

Affected systems

Vendors
microsoft
Products
windows_10_1809windows_10_21h2windows_10_22h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2019windows_server_2022windows_server_2025

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-15: 2Active Exploitation · 2026-07-15: 1Patch / Workaround · 2026-07-15: 2Technical Details · 2026-07-15: 107-15
Signal classification2 categories
Active Exploitation
150.0%
Patch
150.0%
Referenced assets1 URL
Full discourse2 posts
  • chiefpie@cplearns2h4ck
    Active Exploitation

    A bunch of my bugs are patched today. One fun bug is CVE-2026-58536, UAF in the cldflt.sys . It is a patch bypass of CVE-2025-62221, caught exploited ITW by Microsoft Threat Intel. I bypassed the patch and exploited it as part of the Microsoft Exploit Research Challenge. https://t.co/xzrQNcDnQh

    Post summary

    The tweet asserts the user bypassed a patch for CVE-2026-58536, exploits it, and cites Microsoft Threat Intelligence reporting its exploitation in the wild.

    8181197538.9K
    2.4K followersView on X
  • Windows Forum@windowsforum
    Patch

    🪟 July Patch Tuesday fixes a Windows Cloud Files flaw that can turn a local account into admin. Install the updates—“privilege escalation” is just Microsoft-speak for “your PC is now theirs.” https://windowsforum.com/threads/cve-2026-58536-install-july-updates-to-fix-windows-privilege-escalation.438848/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity #PrivilegeEscalation #PatchTuesday https://t.co/1t8pyOFIg2

    Post summary

    The tweet highlights that a Patch Tuesday update resolves a Windows Cloud Files privilege escalation flaw, urging users to install the new releases.

    0000016
    1.2K followersView on X
CPE platform detail10 entries

10 of 10 entries

PartVendorProductVersionTarget SWTarget HW
OSmicrosoftwindows_10_1809--x64
OSmicrosoftwindows_10_1809--x86
OSmicrosoftwindows_10_21h2---
OSmicrosoftwindows_10_22h2---
OSmicrosoftwindows_11_24h2---
OSmicrosoftwindows_11_25h2---
OSmicrosoftwindows_11_26h1---
OSmicrosoftwindows_server_2019---
OSmicrosoftwindows_server_2022---
OSmicrosoftwindows_server_2025---

Explore more

Back to dashboardmicrosoft CVEswindows_10_1809 vulnerabilities