CVE Vulnerability Advisory Database

[Affected Scope] Locally authenticated users across Microsoft Windows operating systems

[Impact] Local attackers can elevate privileges to SYSTEM level, gaining full control over the target system and executing arbitrary code

[Mitigation] Apply the official Microsoft security patches immediately and restrict local access on unpatched assets

[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack

[Impact] A local authorized attacker can exploit improper link resolution to elevate privileges to SYSTEM, leading to complete system compromise

[Mitigation] Apply the official Microsoft security updates immediately, or restrict local symbolic link creation privileges as a temporary mitigation

[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Ancillary Function Driver for WinSock (afd.sys)

[Impact] An authorized local attacker can exploit kernel memory corruption to execute arbitrary code with SYSTEM privileges, leading to complete system compromise

[Mitigation] Immediately apply the latest cumulative security updates provided by Microsoft and restrict unauthorized local access

[Affected Scope] Internet Key Exchange (IKE) Extension service running on Microsoft Windows and Windows Server operating systems

[Impact] An unauthenticated remote attacker can execute arbitrary code with system/kernel privileges over the network by sending specially crafted IKE packets

[Mitigation] Apply the official Microsoft security updates immediately, and restrict external access to IKE/IPsec ports (UDP 500/4500) as a temporary workaround

[Affected Scope] Microsoft Windows operating systems utilizing the Windows Shell component

[Impact] Unauthorized remote attackers can bypass security warnings to perform network-based spoofing, potentially leading to credential harvesting or malware delivery

[Mitigation] Apply the official Microsoft security updates immediately and restrict outbound SMB/WebDAV traffic

[Affected Scope] Windows operating systems running Windows Remote Desktop services

[Impact] An authorized local attacker can elevate privileges to SYSTEM level, gaining full control over the target system

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and enforce Network Level Authentication (NLA)

[Affected Scope] Windows and Windows Server operating systems utilizing the Windows Remote Access Connection Manager (RasMan) service.

[Impact] An unauthorized local attacker can trigger a Null Pointer Dereference in the RasMan service, causing a local Denial of Service (DoS) by crashing the service or the entire system.

[Mitigation] Apply the latest Microsoft cumulative security updates immediately, or disable the RasMan service if remote access features are not required.

[Affected Scope] Desktop Window Manager (DWM) component within Microsoft Windows operating systems

[Impact] An authorized local attacker can exploit a type confusion vulnerability to elevate privileges to SYSTEM, enabling full system compromise

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and monitor endpoint process creation events for anomalous DWM behavior

[Affected Scope] Applications and system components utilizing the MSHTML (Trident) engine within Microsoft Windows environments

[Impact] Unauthorized network attackers can bypass critical security boundaries and sandbox protections, potentially leading to remote code execution

[Mitigation] Apply the latest Microsoft cumulative security updates immediately, or implement registry-based workarounds to restrict MSHTML rendering

[Affected Scope] Windows Shell component across Microsoft Windows operating systems

[Impact] Unauthorized network attackers can bypass critical security boundaries, potentially leading to arbitrary code execution via user interaction

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict outbound SMB/WebDAV traffic

[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Desktop Windows Manager (DWM) component

[Impact] An authorized local attacker can disclose sensitive information from kernel or process memory, potentially facilitating subsequent privilege escalation

[Mitigation] Immediately apply the latest Microsoft cumulative security updates and restrict unauthorized local access on unpatched systems

[Affected Scope] Windows operating systems utilizing the Windows Cloud Files Mini Filter Driver (cldflt.sys)

[Impact] Local authorized attackers can corrupt kernel memory to elevate privileges to SYSTEM and execute arbitrary code

[Mitigation] Immediately apply the official Microsoft security updates and monitor mini-filter driver activities

[Affected Scope] Windows operating system kernel components and environments utilizing shared resources

[Impact] An authorized local attacker can trigger a race condition to cause kernel memory corruption, leading to local privilege escalation (LPE) to SYSTEM level

[Mitigation] Immediately apply the official Microsoft cumulative security updates and restrict local access privileges on unpatched systems

[Affected Scope] All Windows operating systems utilizing the Host Process for Windows Tasks (taskhostw.exe).

[Impact] An authorized local attacker can exploit improper link resolution to elevate privileges to SYSTEM, leading to complete system compromise.

[Mitigation] Apply the official Microsoft security patches immediately, and implement temporary workarounds and monitoring scripts prior to patching.

[Affected Scope] Windows and Windows Server systems running the Remote Access Connection Manager (RasMan) service

[Impact] An authorized local attacker can elevate privileges to SYSTEM, gaining full administrative control over the affected host

[Mitigation] Apply the latest Microsoft cumulative security updates immediately, or disable the RasMan service as a temporary workaround

[Affected Scope] Microsoft Windows operating systems with the third-party Agere Modem driver (ltmdm64.sys) installed or natively shipped

[Impact] Local attackers can execute arbitrary code with SYSTEM privileges, leading to full host compromise. This vulnerability is actively exploited in the wild (CISA KEV)

[Mitigation] Apply the Microsoft October cumulative update to completely remove the driver, or manually disable and restrict the driver service

[Affected Scope] All Windows and Windows Server systems utilizing the SMBv3 protocol within Active Directory domains or workgroups

[Impact] An authenticated attacker with network access can exploit improper access control in SMB to elevate privileges to SYSTEM and execute arbitrary code

[Mitigation] Apply the latest Microsoft Cumulative Updates immediately and restrict SMB (TCP 445) inbound traffic using firewalls

[Affected Scope] Microsoft Windows operating systems including Windows 10, Windows 11, and Windows Server supporting Internet Shortcut (.url) files.

[Impact] An unauthorized remote attacker can execute arbitrary code with the privileges of the logged-in user by tricking them into opening a crafted .url file that references a malicious WebDAV/SMB share.

[Mitigation] Apply the latest Microsoft cumulative security updates immediately, disable the WebClient service, and block outbound SMB and WebDAV traffic at the perimeter firewall.

[Affected Scope] Windows and Windows Server operating systems utilizing the WinSock Ancillary Function Driver (afd.sys)

[Impact] An authorized local attacker can execute arbitrary code in kernel mode, elevating privileges to SYSTEM, which is actively exploited in the wild

[Mitigation] Immediately apply the official Microsoft security updates and restrict unauthorized local access to critical systems

[Affected Scope] Microsoft Windows 10, 11, and Windows Server operating systems utilizing the Common Log File System (CLFS) driver

[Impact] An authorized local attacker can exploit this vulnerability to elevate privileges to SYSTEM level and gain full control of the host

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and monitor for anomalous CLFS log file activities