CVE-2026-61349 Overview
CVE-2026-61349 is a use-after-free vulnerability in the Windows Work Folder Service that allows an authorized local attacker to elevate privileges. The flaw is rooted in a race condition [CWE-362] where an object is accessed after being freed, enabling manipulation of memory the service still references. Successful exploitation grants the attacker higher privileges on the local system, impacting confidentiality, integrity, and availability. Microsoft published the advisory on 2026-08-11, and it affects a broad range of supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2012 through 2025.
Critical Impact
An authenticated local attacker can win a race in the Work Folder Service to trigger a use-after-free and gain elevated privileges on affected Windows systems.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-61349 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-61349
Vulnerability Analysis
The vulnerability resides in the Windows Work Folder Service, a component that synchronizes files between user devices and enterprise file servers. The service mishandles the lifecycle of an internal object, freeing it while another execution path still holds a reference. When the dangling reference is dereferenced, the attacker can influence the freed memory region, redirecting execution or corrupting kernel or service state. Exploitation requires local access and a valid set of low-privilege credentials, and no user interaction is needed to trigger the flaw.
Root Cause
The defect is classified as [CWE-362], a concurrent execution using shared resource with improper synchronization (race condition), leading to a use-after-free. Two threads operate on the same object without adequate locking, allowing one path to release the object while the other continues to use it.
Attack Vector
An authorized local attacker interacts with the Work Folder Service through its exposed interfaces and issues requests that race the internal object lifecycle. By repeatedly triggering the race, the attacker forces the service to dereference freed memory that has been reallocated with attacker-controlled data. This grants code execution or memory corruption within the service context, escalating privileges on the host. No public proof-of-concept exploit is currently listed, and the vulnerability is not on the CISA Known Exploited Vulnerabilities list.
No verified public exploit code is available. See the Microsoft Security Update Guide for authoritative technical details.
Detection Methods for CVE-2026-61349
Indicators of Compromise
- Unexpected crashes or restarts of the Work Folder Service (WorkFolderssvc) recorded in the System event log.
- New processes spawned by the Work Folder Service process running under SYSTEM or other elevated contexts.
- Anomalous privilege escalation events from standard user accounts on hosts where Work Folders is enabled.
Detection Strategies
- Monitor Windows Error Reporting and application crash logs for repeated faults in the Work Folder Service, which may indicate exploitation attempts.
- Correlate low-privilege user activity with subsequent creation of high-privilege processes or token elevation events (Event ID 4672).
- Baseline normal Work Folder Service behavior and alert on deviations such as unexpected child processes or module loads.
Monitoring Recommendations
- Enable process creation auditing (Event ID 4688) with command-line logging on all affected Windows endpoints and servers.
- Ship endpoint telemetry, service crash data, and security events to a centralized analytics platform for cross-host correlation.
- Track patch deployment status across the fleet and flag hosts that remain unpatched after the Microsoft security update is released.
How to Mitigate CVE-2026-61349
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-61349 on all affected systems.
- Prioritize patching multi-user hosts, terminal servers, and file servers where Work Folders is enabled.
- Restrict local logon rights on affected systems to reduce the population of accounts able to trigger the flaw.
Patch Information
Microsoft has issued a security update for CVE-2026-61349 through the standard Windows Update channels. Refer to the Microsoft Security Update Guide for the specific KB articles that correspond to each affected Windows version and build.
Workarounds
- Disable the Work Folder Service (WorkFolderssvc) on systems that do not require Work Folders functionality until patches are applied.
- Enforce least privilege and remove unnecessary interactive logon rights for standard users on servers exposing the service.
- Segment servers running Work Folders and limit which endpoints can reach them administratively.
# Disable the Work Folder Service on hosts that do not require it
sc.exe config WorkFolderssvc start= disabled
sc.exe stop WorkFolderssvc
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
