CVE-2026-83991 Overview
CVE-2026-83991 is a local tampering vulnerability in the Windows Cloud Files Mini Filter Driver (cldflt.sys). The driver exposes a critical function without proper authentication, allowing an authorized local attacker to tamper with data protected by the driver. Microsoft classifies this as an integrity-impact issue affecting Windows 10, Windows 11, and Windows Server releases. The weakness maps to [CWE-306] Missing Authentication for Critical Function.
Critical Impact
A local authenticated attacker can bypass authentication checks in the Cloud Files Mini Filter Driver to tamper with protected data, undermining the integrity of files synchronized through cloud providers such as OneDrive.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2) — x86, x64, ARM64
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) — x64, ARM64
- Microsoft Windows Server 2019, 2022, and 2025
Discovery Timeline
- 2026-09-08 - CVE-2026-83991 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-83991
Vulnerability Analysis
The Cloud Files Mini Filter Driver (cldflt.sys) implements the file system filter component behind the Windows Cloud Files API. It brokers placeholder files, hydration requests, and state changes between user-mode sync engines such as OneDrive and NTFS. The driver exposes IOCTLs and control operations that modify file state, attributes, and reparse data on-disk.
The vulnerability stems from a critical function inside the driver that does not verify the caller's authorization context before performing state-changing operations. A local user with standard privileges can invoke the operation and modify data that the driver is expected to protect. The scope is unchanged, and successful exploitation yields high integrity impact without exposing confidentiality or availability.
Root Cause
The root cause is a missing authentication check on a security-critical entry point in cldflt.sys [CWE-306]. The driver treats an authenticated local caller as trusted for an operation that should require additional verification of the caller's rights or the target object's ownership. Because the check is absent, any local process running under a valid user token can reach the vulnerable code path.
Attack Vector
Exploitation requires local access and low privileges. No user interaction is needed. An attacker executes a purpose-built process that opens a handle to the Cloud Files filter and issues the unauthenticated control request to tamper with files or placeholder metadata managed by the driver. Refer to the Microsoft Security Update Guide for vendor-supplied technical detail. No public proof-of-concept code is available at the time of publication.
Detection Methods for CVE-2026-83991
Indicators of Compromise
- Unexpected modification of OneDrive or Cloud Files placeholder files, including reparse point changes made outside of the sync engine process.
- Non-OneDrive.exe or non-sync-engine processes opening handles to \Device\CldFlt or issuing FSCTL/IOCTL calls against Cloud Files-managed paths.
- Integrity mismatches reported by the sync client between local placeholder state and cloud-side content.
Detection Strategies
- Monitor kernel and filter manager telemetry for user-mode processes issuing device control requests to cldflt.sys from non-standard binaries.
- Correlate file modification events on Cloud Files-managed directories with the initiating process; flag modifications from processes that are not the registered sync provider.
- Alert on standard users invoking APIs from cfapi.h (Cloud Filter API) outside of expected sync-provider executables.
Monitoring Recommendations
- Enable Sysmon Event ID 1 (process creation) and Event ID 11 (file create) with rules covering %USERPROFILE%\OneDrive* and other Cloud Files roots.
- Ingest Windows Filtering Platform and file system audit logs into a centralized analytics platform to baseline legitimate Cloud Files activity.
- Track patch state across all Windows 10, Windows 11, and Windows Server hosts to identify systems still exposed to CVE-2026-83991.
How to Mitigate CVE-2026-83991
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-83991 to all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize multi-user systems, terminal servers, and VDI hosts where local low-privileged accounts are common.
- Audit local account inventories and remove unused or dormant users to reduce the population of accounts able to reach the local attack surface.
Patch Information
Microsoft addresses CVE-2026-83991 through the September 2026 security update cycle for Windows 10, Windows 11, and Windows Server 2019/2022/2025. Consult the Microsoft Security Update Guide for the specific KB article and build numbers that apply to each supported release.
Workarounds
- No official workaround is published by Microsoft; installing the security update is the supported remediation.
- On systems that do not use cloud file sync, disable the CldFlt service and remove sync clients such as OneDrive to eliminate the exposed code path.
- Restrict interactive and remote logon rights so that only trusted users can execute local code on affected hosts.
# Check the status of the Cloud Files Mini Filter Driver on a Windows host
fltmc filters | findstr /I cldflt
sc.exe qc CldFlt
# Verify installed update level (example: replace KB number with the applicable one from MSRC)
wmic qfe list brief | findstr /I KB
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
