privilege-escalation-techniqueendpoint-software-vulnerabilitywidely-deployed-product-advisory

Windows CLFS Elevation-of-Privilege Flaws Patched by Microsoft

Attack Tradecraft · 2 sources · Updated 3mo ago · First seen May 25, 2026

Microsoft published security advisories for two Windows Common Log File System (CLFS) Driver elevation-of-privilege vulnerabilities, tracked as CVE-2022-37969 and CVE-2023-36424. Both issues affect the CLFS component in Windows and could allow an attacker to gain higher privileges on a targeted system after successful exploitation.

The advisories were released through Microsoft's Security Update Guide and indicate that the flaws were addressed in separate security updates. The repeated appearance of privilege-escalation bugs in the CLFS driver highlights a sensitive Windows kernel-area component that defenders should prioritize for patching and monitoring, especially on endpoints where local code execution could be chained into SYSTEM-level access.

Who uses this technique?Get the actors, campaigns, and ATT&CK mapping behind it.

Get the tradecraft

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Sep 13, 2022 – Nov 14, 2023

Nov 14, 20233y ago
Microsoft publishes advisory for CVE-2023-36424 CLFS privilege escalation flaw
Microsoft published guidance for CVE-2023-36424, identifying it as a Windows Common Log File System Driver Elevation of Privilege Vulnerability.
Sep 13, 20224y ago
Microsoft publishes advisory for CVE-2022-37969 CLFS privilege escalation flaw
Microsoft added CVE-2022-37969 to its Security Update Guide as a Windows Common Log File System Driver Elevation of Privilege Vulnerability.

Do you run this?Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.

See Who Uses This Technique

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Msrc PortalAdvisories · Nov 14, 2023

CVE-2023-36424 - Security Update Guide - Microsoft - Windows Common Log File System Driver Elevation of Privilege VulnerabilityOpen source ↗

Msrc MicrosoftAdvisories · Sep 13, 2022

CVE-2022-37969 - Security Update Guide - Microsoft - Windows Common Log File System Driver Elevation of Privilege VulnerabilityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Windows CLFS Elevation-of-Privilege Flaws Patched by Microsoft

How this story unfolded

Microsoft publishes advisory for CVE-2023-36424 CLFS privilege escalation flaw

Microsoft publishes advisory for CVE-2022-37969 CLFS privilege escalation flaw

Sources

See the full picture, correlated to your attack surface.

Related stories

Microsoft Patches Multiple Windows CLFS Driver Privilege Escalation Flaws

Microsoft Patches Windows Privilege Escalation Flaws in CLFS Driver and Winlogon

Windows Privilege Escalation Flaws Hit CLFS and Cloud Files Drivers

Windows CLFS Elevation-of-Privilege Flaws Patched by Microsoft

How this story unfolded

Microsoft publishes advisory for CVE-2023-36424 CLFS privilege escalation flaw

Microsoft publishes advisory for CVE-2022-37969 CLFS privilege escalation flaw

Sources

See the full picture, correlated to your attack surface.

Related stories

Microsoft Patches Multiple Windows CLFS Driver Privilege Escalation Flaws

Microsoft Patches Windows Privilege Escalation Flaws in CLFS Driver and Winlogon

Windows Privilege Escalation Flaws Hit CLFS and Cloud Files Drivers