VulnSocial

CVE-2026-83991PoC(microsoft / windows_10_1809)

MEDIUMCVSS 5.5 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for microsoft windows_10_1809 systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally.

microsoft CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-306

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • windows_10_1809
  • windows_10_21h2
  • windows_10_22h2
  • windows_11_23h2

Threat summary

  • Public PoC and exploit tooling are both present
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 3 signals
  • PoC mentioned or linked in 3 signals
  • Technical details provided in 3 signals
  • Peaked 1d ago at 2 mentions (2026-09-09); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
microsoft
Products
windows_10_1809windows_10_21h2windows_10_22h2windows_11_23h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2019windows_server_2022windows_server_2025

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-09-09: 2Mentions · 2026-09-11: 1PoC Mentioned / Linked · 2026-09-09: 2PoC Mentioned / Linked · 2026-09-11: 1Exploit Tool / Code · 2026-09-09: 2Exploit Tool / Code · 2026-09-11: 1Technical Details · 2026-09-09: 2Technical Details · 2026-09-11: 109-0909-11
Signal classification1 categories
PoC
3100.0%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-09-092
PoC2
2026-09-111
PoC1
Full discourse3 posts
  • karollol@karollooool
    PoC

    CVE-2026-83991: GENERIC_WRITE and DeleteFileW both return error 5. Same token, CfCreatePlaceholders with SUPERSEDE returns S_OK. Same file ID, new IO_REPARSE_TAG_CLOUD. Microsoft’s affected range goes back to 2018. Writeup: https://github.com/karollooool/CVE-2026-83991-writeup-and-poc

    Post summary

    The post announces CVE-2026-83991, details its technical behavior, and shares a GitHub writeup containing a Proof‑of‑Concept implementation.

    1220119577.6K
    145 followersView on X
  • Rıdvan Yağlı@ridvanyagli
    PoC

    CVE-2026-83991: Windows Cloud Files Access-Check Bypass https://github.com/karollooool/CVE-2026-83991-writeup-and-poc

    Post summary

    The text promotes a GitHub repository that offers a write‑up and proof‑of‑concept code for CVE‑2026‑83991, a Windows Cloud Files access‑check bypass vulnerability.

    0701541.0K
    2.4K followersView on X
  • Mr.Niko@_MrNiko
    PoC

    🚨 CVE-2026-83991 Windows Cloud Files GENERIC_WRITE: ACCESS_DENIED DeleteFileW: ACCESS_DENIED CfCreatePlaceholders with supersede: S_OK same file. same token. leaf DACL said no. sync root path did not care. turns a read-only file into a cloud placeholder. writeup + PoC by karollooool: https://github.com/karollooool/CVE-2026-83991-writeup-and-poc #VulnerabilityResearch #ExploitDev #InfoSec

    Post summary

    Researcher released a writeup and PoC for CVE‑2026‑83991, showing how a read‑only file can be turned into a cloud placeholder. No evidence of active exploitation or patch availability is mentioned.

    01031302
    1.5K followersView on X
CPE platform detail19 entries

19 of 19 entries

PartVendorProductVersionTarget SWTarget HW
OSmicrosoftwindows_10_1809--x64
OSmicrosoftwindows_10_1809--x86
OSmicrosoftwindows_10_21h2--arm64
OSmicrosoftwindows_10_21h2--x64
OSmicrosoftwindows_10_21h2--x86
OSmicrosoftwindows_10_22h2--arm64
OSmicrosoftwindows_10_22h2--x64
OSmicrosoftwindows_10_22h2--x86
OSmicrosoftwindows_11_23h2--arm64
OSmicrosoftwindows_11_23h2--x64
OSmicrosoftwindows_11_24h2--arm64
OSmicrosoftwindows_11_24h2--x64
OSmicrosoftwindows_11_25h2--arm64
OSmicrosoftwindows_11_25h2--x64
OSmicrosoftwindows_11_26h1--arm64
OSmicrosoftwindows_11_26h1--x64
OSmicrosoftwindows_server_2019---
OSmicrosoftwindows_server_2022---
OSmicrosoftwindows_server_2025---

Explore more

Back to dashboardmicrosoft CVEswindows_10_1809 vulnerabilities