CVE-2026-72971: Windows Container Path Traversal Flaw

CVE-2026-72971 Overview

CVE-2026-72971 is an improper link resolution vulnerability in the Windows Container Isolation FS Filter Driver (unionfs.sys). The flaw allows an authorized local attacker to perform tampering by exploiting how the driver resolves file system links before access [CWE-59]. Successful exploitation results in unauthorized modification of files that the driver operates on with higher privileges. The vulnerability requires local access and low privileges but no user interaction. Microsoft has published tracking information through its Security Update Guide.

Critical Impact
A local authenticated attacker can tamper with files handled by the Container Isolation FS Filter Driver, compromising the integrity of data protected by container isolation boundaries.

Affected Products

Microsoft Windows (Container Isolation FS Filter Driver — unionfs.sys)
Windows Server releases that ship the Container Isolation FS Filter Driver
Windows editions supporting Windows Containers

Discovery Timeline

2026-08-11 - CVE CVE-2026-72971 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72971

Vulnerability Analysis

The vulnerability resides in unionfs.sys, the Windows Container Isolation FS Filter Driver responsible for merging and virtualizing file system views used by Windows Containers. The driver resolves file paths that may traverse symbolic links, junctions, or hard links before performing privileged file operations. When link resolution occurs without validating the final target, an attacker controlling parts of the path can redirect operations to a file outside the intended container scope. The result is tampering with files the attacker would not normally have write access to. The issue is classified under [CWE-59]: Improper Link Resolution Before File Access.

Root Cause

The driver performs file operations after resolving a path that includes attacker-controllable link components. Because the check-to-use sequence does not fully validate the final resolved target, a link created or replaced by an attacker can point the operation at an unintended file. This class of flaw is a link-following weakness that typically overlaps with a race condition (TOCTOU) in filter driver code paths.

Attack Vector

Exploitation requires local access with low privileges on the target system. The attacker plants or manipulates a symbolic link, junction, or hard link within a directory processed by the container isolation filter. When the driver operates on the crafted path, the operation is redirected to a file the attacker cannot normally write. No user interaction is required, and the impact is limited to integrity — confidentiality and availability are not directly affected.

No verified public exploit code is available. Refer to the Microsoft CVE-2026-72971 Update Guide for authoritative technical details.

Detection Methods for CVE-2026-72971

Indicators of Compromise

Creation of symbolic links, junctions, or hard links inside directories used by Windows Containers or overlay file systems backed by unionfs.sys.
Unexpected modification of protected files owned by SYSTEM or container-managed accounts following local user activity.
Event Tracing for Windows (ETW) records showing unionfs.sys operations that resolve to targets outside the expected container scope.

Detection Strategies

Monitor file system minifilter activity for reparse point creation followed by writes performed by unionfs.sys on unexpected targets.
Correlate low-privilege process activity with elevated file writes occurring through the container isolation stack.
Alert on use of mklink, CreateSymbolicLink, or DeviceIoControl with FSCTL_SET_REPARSE_POINT originating from non-administrative processes in container-adjacent paths.

Monitoring Recommendations

Enable auditing on directories used as container scratch and layer storage locations.
Ingest Sysmon Event ID 11 (file create) and Event ID 2 (file creation time changed) into a centralized analytics platform for baseline deviation analysis.
Track loading and configuration changes to unionfs.sys across the fleet to identify tampering attempts.

How to Mitigate CVE-2026-72971

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-72971 Update Guide as soon as it is available for your Windows build.
Inventory hosts running Windows Containers or workloads that depend on unionfs.sys and prioritize patching those systems.
Restrict local logon rights on container hosts to reduce the population of accounts capable of exploiting the flaw.

Patch Information

Microsoft tracks remediation for CVE-2026-72971 through the Microsoft Security Update Guide. Administrators should consult the guide for the specific KB articles and build numbers that address the vulnerability on each supported Windows release, then deploy through Windows Update, WSUS, or Microsoft Update Catalog.

Workarounds

Limit membership of local groups that can create symbolic links; adjust the SeCreateSymbolicLinkPrivilege assignment through Group Policy.
Disable the Windows Containers feature on hosts that do not require it until patches are applied.
Enforce least-privilege access to directories consumed by the Container Isolation FS Filter Driver so that unprivileged users cannot stage malicious link structures.

bash

# Review accounts granted the Create Symbolic Links privilege
secedit /export /cfg C:\Temp\secpol.cfg
findstr /I "SeCreateSymbolicLinkPrivilege" C:\Temp\secpol.cfg

# Confirm patch level after applying the Microsoft update
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10