CVE-2026-35603: Claude Code Privilege Escalation Flaw

CVE-2026-35603 Overview

Claude Code is an agentic coding tool developed by Anthropic. In versions prior to 2.1.75 on Windows, the application loaded the system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or access permissions. Because the ProgramData directory is writable by non-administrative users by default and the ClaudeCode subdirectory was not pre-created or access-restricted, a low-privileged local user could create this directory and place a malicious configuration file that would be automatically loaded for any user launching Claude Code on the same machine.

Critical Impact

Local privilege escalation through untrusted search path allows low-privileged attackers to inject malicious configurations affecting all users on shared Windows systems.

Affected Products

• Anthropic Claude Code versions prior to 2.1.75
• Microsoft Windows (all supported versions)
• Claude Code for Node.js runtime

Discovery Timeline

• April 17, 2026 - CVE-2026-35603 published to NVD
• April 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35603

Vulnerability Analysis

This vulnerability is classified as CWE-426 (Untrusted Search Path), which occurs when an application searches for files or resources in locations that can be influenced by untrusted parties. The core issue lies in how Claude Code on Windows handles its configuration file loading mechanism. When the application initializes, it attempts to load managed settings from a predictable system-wide location without first verifying that the directory and file have appropriate access controls in place.

The exploitation requires a shared multi-user Windows environment where multiple users operate on the same system. An attacker with low-privileged access can pre-emptively create the ClaudeCode directory under C:\ProgramData and populate it with a crafted managed-settings.json file. Since Windows does not restrict standard users from creating directories within ProgramData by default, this attack path is readily available on unpatched systems. When a victim user subsequently launches Claude Code, the application loads the attacker-controlled configuration, potentially allowing arbitrary code execution or data exfiltration depending on the configuration options available.

Root Cause

The root cause is the application's failure to implement proper directory ownership validation and access permission checks before loading configuration files from a shared system location. The C:\ProgramData directory by default allows non-administrative users to create new subdirectories, and Claude Code did not pre-create the ClaudeCode subdirectory with restricted permissions during installation. This creates a race condition where an attacker can establish control over the configuration directory before the legitimate application installation or first use.

Attack Vector

The attack is local in nature, requiring an attacker to have existing access to the target Windows system. The exploitation process involves the attacker creating the directory structure at C:\ProgramData\ClaudeCode\ and placing a malicious managed-settings.json file within it. This file would then be loaded by any user who launches Claude Code on that system, inheriting whatever malicious configurations the attacker has specified. The attack requires user interaction from the victim, as they must launch the Claude Code application after the malicious configuration has been placed.

The vulnerability is particularly impactful in enterprise or shared computing environments such as:

• Corporate workstations with multiple user profiles
• Shared development environments
• Terminal servers and remote desktop deployments
• Educational computer labs

Detection Methods for CVE-2026-35603

Indicators of Compromise

• Presence of unexpected directories or files at C:\ProgramData\ClaudeCode\ with ownership by non-administrative accounts
• Modified timestamps on managed-settings.json that predate Claude Code installation
• File ownership and ACLs on the ClaudeCode directory that differ from expected installation patterns
• Unexpected configuration values when Claude Code loads that were not set by the user or administrator

Detection Strategies

• Monitor file system activity for directory creation under C:\ProgramData\ by non-SYSTEM and non-Administrator accounts
• Implement file integrity monitoring (FIM) on C:\ProgramData\ClaudeCode\managed-settings.json to detect unauthorized modifications
• Deploy EDR solutions such as SentinelOne to detect anomalous configuration file manipulation patterns
• Review Windows Security Event logs for EventID 4663 (file creation) targeting the ProgramData directory path

Monitoring Recommendations

• Configure SentinelOne policies to alert on suspicious file creation events within C:\ProgramData\ by standard user accounts
• Establish baseline file ownership for application directories and alert on deviations
• Implement periodic audits of shared system directories for unexpected content or permission changes

How to Mitigate CVE-2026-35603

Immediate Actions Required

• Upgrade Claude Code to version 2.1.75 or later immediately on all Windows systems
• Audit existing installations for presence of unauthorized C:\ProgramData\ClaudeCode\ directories
• Remove any pre-existing ClaudeCode directories that were not created by the official installer
• Restrict permissions on C:\ProgramData\ClaudeCode\ to SYSTEM and Administrators only if manual remediation is required

Patch Information

Anthropic has addressed this vulnerability in Claude Code version 2.1.75. The fix implements proper directory ownership validation and access permission checks before loading configuration files. Organizations should update to the patched version through their standard Node.js package management processes. For detailed patch information, refer to the GitHub Security Advisory GHSA-5cwg-9f6j-9jvx.

Workarounds

• Pre-create the C:\ProgramData\ClaudeCode\ directory with restricted ACLs (SYSTEM and Administrators full control only) before any standard user accesses the system
• Deploy Group Policy to restrict write access to C:\ProgramData\ subdirectories for non-administrative users where feasible
• Consider running Claude Code in isolated user profiles or containerized environments on shared systems until the patch is applied

# PowerShell: Create secure directory with restricted permissions
New-Item -Path "C:\ProgramData\ClaudeCode" -ItemType Directory -Force
$acl = Get-Acl "C:\ProgramData\ClaudeCode"
$acl.SetAccessRuleProtection($true, $false)
$adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Administrators","FullControl","ContainerInherit,ObjectInherit","None","Allow")
$systemRule = New-Object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\SYSTEM","FullControl","ContainerInherit,ObjectInherit","None","Allow")
$acl.AddAccessRule($adminRule)
$acl.AddAccessRule($systemRule)
Set-Acl "C:\ProgramData\ClaudeCode" $acl