CVE-2026-62775 Overview
CVE-2026-62775 is an incorrect authorization vulnerability in the Windows Container Isolation FS Filter Driver (unionfs.sys). The flaw allows an authenticated local attacker to disclose sensitive information on affected Microsoft Windows 11 26H1 systems. The vulnerability is tracked under CWE-863: Incorrect Authorization and requires low privileges with no user interaction.
Critical Impact
An authorized local attacker can bypass authorization checks in unionfs.sys to read information that should be isolated by the container filesystem filter driver, exposing data across container boundaries.
Affected Products
- Microsoft Windows 11 26H1 (x64)
- Microsoft Windows 11 26H1 (ARM64)
- Windows Container Isolation FS Filter Driver (unionfs.sys)
Discovery Timeline
- 2026-08-11 - CVE-2026-62775 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-62775
Vulnerability Analysis
The vulnerability resides in unionfs.sys, the Windows Container Isolation FS Filter Driver that layers container filesystems over host filesystems. The driver performs incorrect authorization checks when handling filesystem requests within isolated containers. An authorized user on the local system can leverage this flaw to access data that the authorization model intends to keep confidential.
The vulnerability affects confidentiality only. Integrity and availability of the system remain intact, and the attack scope is unchanged. Exploitation requires local access and valid credentials, limiting remote exploitation potential.
The EPSS probability of 0.264% (18th percentile) indicates a low likelihood of exploitation activity in the near term. No public proof-of-concept code and no confirmed in-the-wild exploitation have been reported.
Root Cause
The root cause is an incorrect authorization implementation (CWE-863) within the container isolation filter driver. When unionfs.sys receives filesystem I/O requests, it does not correctly validate whether the caller is authorized to access the requested resource. This gap allows a local user to reach information that the container boundary should protect.
Attack Vector
An attacker requires local access and authenticated, low-privilege access to the target host. The attacker interacts with the container filesystem layer through standard filesystem APIs or crafted requests that traverse unionfs.sys. Because the driver enforces authorization incorrectly, the attacker obtains read access to files or metadata that should remain isolated.
No user interaction is required, and the attack complexity is low. Refer to the Microsoft Security Update Guide for CVE-2026-62775 for vendor technical details.
Detection Methods for CVE-2026-62775
Indicators of Compromise
- Unexpected process activity from low-privileged accounts issuing filesystem I/O against container mount points or unionfs.sys handles.
- Anomalous file read operations targeting container layer paths from user-mode processes outside container context.
- Kernel driver load events for unionfs.sys correlated with unusual local user sessions.
Detection Strategies
- Monitor Windows kernel and filter manager telemetry for irregular filesystem callback activity involving unionfs.sys.
- Alert on local processes accessing container isolation namespaces without a corresponding container runtime parent process.
- Correlate Sysmon file access events with process integrity levels to surface low-privilege reads of protected container data.
Monitoring Recommendations
- Ingest kernel driver, filter manager, and process telemetry into a centralized SIEM for cross-source correlation.
- Baseline normal container filesystem access patterns per host to detect deviations quickly.
- Track patch deployment status across all Windows 11 26H1 endpoints to identify unpatched systems still exposed.
How to Mitigate CVE-2026-62775
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62775 to all Windows 11 26H1 hosts.
- Inventory endpoints running Windows 11 26H1 on x64 and ARM64 to confirm patch coverage.
- Restrict interactive and remote local logon rights on hosts running Windows containers to reduce the pool of potential attackers.
Patch Information
Microsoft has published the security update through the Microsoft Security Update Guide. Administrators should deploy the update through Windows Update, Windows Server Update Services (WSUS), or Microsoft Intune according to standard change management processes. Verify the update installs successfully and that unionfs.sys is updated to the patched version.
Workarounds
- Where patching is delayed, limit which users can execute workloads on hosts that use Windows Container Isolation.
- Enforce least-privilege access controls and disable unnecessary local accounts on container hosts.
- Increase auditing on container hosts to detect exploitation attempts until the patch is applied.
# Verify Windows 11 26H1 build and unionfs.sys version after patching
Get-ComputerInfo | Select-Object OsName, OsVersion, OsBuildNumber
Get-Item C:\Windows\System32\drivers\unionfs.sys | Select-Object Name, VersionInfo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
