CVE-2026-65680: Microsoft OneDrive Privilege Escalation

CVE-2026-65680 Overview

CVE-2026-65680 is a link-following vulnerability [CWE-59] in Microsoft OneDrive that enables local privilege escalation. An authorized attacker with existing local access can abuse improper link resolution before file access to gain higher privileges on the affected system. The flaw does not require user interaction and can be triggered with a low-complexity local attack.

Microsoft published details through its Security Response Center advisory. The vulnerability affects the confidentiality, integrity, and availability of the host once exploited. No public exploit or in-the-wild activity has been reported as of the article publication date.

Critical Impact
A local, authenticated attacker can elevate privileges through symbolic or hard link manipulation targeting OneDrive file operations, gaining full impact on confidentiality, integrity, and availability.

Affected Products

Microsoft OneDrive (client on Windows)
Refer to the Microsoft Security Response Center advisory for the full list of affected builds
Vendor-supplied fixed versions listed in the MSRC update guide

Discovery Timeline

2026-08-11 - CVE-2026-65680 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-65680

Vulnerability Analysis

The vulnerability stems from improper handling of file system links during OneDrive file operations. When OneDrive processes a file path, it fails to validate whether the target is a symbolic link, junction, or hard link before performing privileged file access. An attacker who controls a location OneDrive operates on can plant a link that redirects file operations to a sensitive target.

Because the OneDrive process runs with privileges higher than the attacker, the redirected write, delete, or replace operation is executed against files the attacker cannot normally modify. This class of flaw is tracked as [CWE-59] Improper Link Resolution Before File Access. Successful exploitation grants the attacker code execution or file control at the OneDrive service context.

Root Cause

OneDrive performs file access operations without resolving and validating the final target of a link. The absence of reparse-point checks and impersonation during file I/O allows the attacker's low-privilege link to be followed into a protected path. This is a canonical Time-of-Check to Time-of-Use pattern combined with missing link validation.

Attack Vector

Exploitation requires local access and existing user-level privileges on the target host. The attacker prepares a directory containing a crafted symbolic link or NTFS junction that points at a system-owned file. When OneDrive later reads, writes, or deletes the attacker-controlled path, the operation follows the link and acts on the protected target. No user interaction is required to complete the attack.

See the Microsoft CVE-2026-65680 Update advisory for vendor-specific technical details.

Detection Methods for CVE-2026-65680

Indicators of Compromise

Creation of symbolic links, junctions, or hard links within user-writable OneDrive working directories such as %LOCALAPPDATA%\Microsoft\OneDrive
OneDrive process (OneDrive.exe) performing file writes or deletions on paths outside its expected profile scope
Unexpected modification timestamps on system files following OneDrive activity
New or modified reparse points in temporary or sync staging folders

Detection Strategies

Monitor Windows Sysmon Event ID 11 (FileCreate) and Event ID 2 (FileCreateTime) for reparse-point creation by non-administrative users
Alert on OneDrive.exe file operations that resolve to paths under C:\Windows, C:\Program Files, or other protected directories
Correlate CreateSymbolicLink and mklink command-line usage with subsequent OneDrive I/O activity

Monitoring Recommendations

Ingest endpoint file and process telemetry into a centralized data lake for behavioral correlation across sync clients
Baseline expected OneDrive file paths per user and flag deviations to system directories
Track privilege changes and unexpected token elevation events tied to OneDrive child processes

How to Mitigate CVE-2026-65680

Immediate Actions Required

Apply the Microsoft OneDrive security update referenced in the MSRC advisory for CVE-2026-65680
Verify that OneDrive auto-update is enabled so patched client builds deploy without user action
Audit endpoints for existing symbolic links inside OneDrive working directories and remove untrusted entries
Restrict SeCreateSymbolicLinkPrivilege to administrators via Group Policy on managed hosts

Patch Information

Microsoft has issued a fix for CVE-2026-65680 through the OneDrive client update channel. Confirm the installed OneDrive version against the fixed build listed in the MSRC update guide. Enterprise environments using deferred update rings should promote this update to production immediately given the local privilege escalation impact.

Workarounds

Remove the SeCreateSymbolicLinkPrivilege right from standard user accounts through secpol.msc or Group Policy
Restrict interactive logon on servers where OneDrive is installed to reduce local attack surface
Enforce application control policies that block unauthorized processes from writing into OneDrive sync directories

bash

# Verify OneDrive client version on Windows
"%LOCALAPPDATA%\Microsoft\OneDrive\OneDrive.exe" /version

# Remove symbolic link creation privilege from standard users (Group Policy path)
# Computer Configuration > Windows Settings > Security Settings >
#   Local Policies > User Rights Assignment > "Create symbolic links"