Loading story…
Microsoft patched CVE-2026-50458, a high-severity local privilege escalation flaw in the Windows Brokering File System driver, bfs.sys, that affects Windows 11 and Windows Server 2025. The vulnerability stems from a race condition that can trigger a use-after-free in BFS internal directory handling, allowing a locally authenticated attacker or sandboxed code to corrupt kernel memory and elevate privileges to SYSTEM.
Affected platforms include Windows 11 24H2, 25H2, and 26H1 on x64 and ARM64, along with Windows Server 2025 including Server Core, prior to patched builds. Microsoft assigned the issue a CVSS 7.8 rating and addressed it in July 2026 security updates, including KB5101650 for Windows 11 24H2 and 25H2. Public discussion around the bug includes a technical deep dive into the kernel minifilter vulnerability, but there are no confirmed reports of active exploitation, and the flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A technical deep dive described CVE-2026-50458 as a use-after-free vulnerability in the Windows Brokering File System minifilter driver, bfs.sys. Reporting says the flaw stems from a race condition in BFS internal directory handling that can let a locally authenticated attacker or sandboxed code corrupt kernel memory and escalate privileges to SYSTEM.
Microsoft fixed CVE-2026-50458, a high-severity local privilege escalation flaw in the Windows Brokering File System driver bfs.sys, in its July 2026 security updates. The issue affects Windows 11 and Windows Server 2025 before the patched builds, and one cited fix is KB5101650 for Windows 11 24H2 and 25H2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcereddit.com
Open sourcerotcee.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed two **Elevation of Privilege** vulnerabilities in the **Microsoft Brokering File System**, tracked as `CVE-2025-49693` and `CVE-2026-32219`, through its Security Update Guide. Both advisories identify the same Windows component as affected, indicating a recurring privilege-escalation risk in the brokering layer that manages file system operations. The vulnerabilities could allow an attacker with local access to gain higher privileges on a targeted Windows system if successfully exploited. Microsoft published security updates for both issues and organizations using affected Windows platforms should prioritize patching, validate update deployment across endpoints and servers, and monitor for signs of post-compromise privilege escalation involving the Brokering File System component.
Jul 12, 2026
A public proof-of-concept exploit has been released for **CVE-2026-42980**, a high-severity Windows NT OS Kernel elevation-of-privilege flaw that allows a locally authenticated low-privileged user to gain **`NT AUTHORITY\SYSTEM`** access. The vulnerability stems from an integer underflow in the kernel's WMI serialization code that can trigger a heap-based buffer overflow and kernel memory corruption on supported Windows client and server releases, including Windows 10 Version 1607 and later builds. Microsoft patched the issue in its June 2026 Patch Tuesday updates, assigned it a **CVSS 3.1 score of `7.8`**, and assessed exploitation as **"more likely."** While there is no confirmed in-the-wild exploitation reported so far, the availability of exploit code raises the risk that attackers could use the bug after initial compromise to obtain full machine control, particularly on shared systems and servers. Microsoft has not provided a configuration workaround, making prompt deployment and validation of the June 2026 cumulative updates the primary mitigation.
Jul 23, 2026
Microsoft disclosed and patched multiple **elevation-of-privilege vulnerabilities** in the **Windows Common Log File System (CLFS) Driver**, including `CVE-2026-40407`, `CVE-2025-62470`, and `CVE-2025-32713`. The most detailed advisory, for `CVE-2026-40407`, describes a **heap-based buffer overflow** (`CWE-122`) that allows a locally authenticated low-privilege attacker to escalate to **SYSTEM** without user interaction. Microsoft rated `CVE-2026-40407` as **Important** with a **CVSS 3.1 score of 7.8**, citing **high** impact to confidentiality, integrity, and availability. The company said the flaw had **not** been publicly disclosed and was **not** being exploited in the wild at the time of publication, assessed exploitation as unlikely, and released an official security update to remediate the issue; the related CLFS advisories indicate a continuing pattern of privilege-escalation risk in this Windows component.
Jul 12, 2026