{"id":"CVE-2026-83991","title":"Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally.","summary":"Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally.","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-306"],"vendor":"microsoft","product":"windows_10_1809","affected":["windows_10_1809 < 10.0.17763.9245","windows_10_21h2 < 10.0.19044.7725","windows_10_22h2 < 10.0.19045.7725","windows_11_23h2 < 10.0.22631.7582","windows_11_24h2 < 10.0.26100.9445","windows_11_25h2 < 10.0.26200.9445","windows_11_26h1 < 10.0.28000.2954","windows_server_2019 < 10.0.17763.9245","windows_server_2022 < 10.0.20348.5622","windows_server_2025 < 10.0.26100.33438"],"patched":["windows_10_1809 10.0.17763.9245","windows_10_21h2 10.0.19044.7725","windows_10_22h2 10.0.19045.7725","windows_11_23h2 10.0.22631.7582","windows_11_24h2 10.0.26100.9445","windows_11_25h2 10.0.26200.9445","windows_11_26h1 10.0.28000.2954","windows_server_2019 10.0.17763.9245","windows_server_2022 10.0.20348.5622","windows_server_2025 10.0.26100.33438"],"published":"2026-09-08","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:14:54.747","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83991","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83991","label":"secure@microsoft.com"}],"tags":["nvd","cve.org","exploit-available"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T18:34:37.479939Z"},"epss":0.00341,"epssPercentile":0.27611,"exploits":{"github":2,"githubRepos":["https://github.com/karollooool/CVE-2026-83991-writeup-and-poc","https://github.com/ZeroDayVPN/CVE-2026-83991-WriteUP-and-PoC"],"checkedAt":"2026-09-21T15:30:56.503Z"},"exploitAvailable":true,"ingestedAt":"2026-09-08T19:08:49.633Z","slug":"CVE-2026-83991","body":"## Overview\n\nMissing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally.\n\n## Affected\n\n- `windows_10_1809 < 10.0.17763.9245`\n- `windows_10_21h2 < 10.0.19044.7725`\n- `windows_10_22h2 < 10.0.19045.7725`\n- `windows_11_23h2 < 10.0.22631.7582`\n- `windows_11_24h2 < 10.0.26100.9445`\n- `windows_11_25h2 < 10.0.26200.9445`\n- `windows_11_26h1 < 10.0.28000.2954`\n- `windows_server_2019 < 10.0.17763.9245`\n- `windows_server_2022 < 10.0.20348.5622`\n- `windows_server_2025 < 10.0.26100.33438`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `windows_10_1809 10.0.17763.9245`\n- `windows_10_21h2 10.0.19044.7725`\n- `windows_10_22h2 10.0.19045.7725`\n- `windows_11_23h2 10.0.22631.7582`\n- `windows_11_24h2 10.0.26100.9445`\n- `windows_11_25h2 10.0.26200.9445`\n- `windows_11_26h1 10.0.28000.2954`\n- `windows_server_2019 10.0.17763.9245`\n- `windows_server_2022 10.0.20348.5622`\n- `windows_server_2025 10.0.26100.33438`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":202013,"id":"CVE-2026-83991","ts":1789400015946,"field":"exploit_available","old":"false","new":"true"},{"seq":200740,"id":"CVE-2026-83991","ts":1789397602039,"field":"exploit_available","old":"true","new":"false"},{"seq":199435,"id":"CVE-2026-83991","ts":1789395509112,"field":"exploit_available","old":"false","new":"true"},{"seq":198680,"id":"CVE-2026-83991","ts":1789392200854,"field":"exploit_available","old":"true","new":"false"},{"seq":197013,"id":"CVE-2026-83991","ts":1789384288032,"field":"exploit_available","old":"false","new":"true"},{"seq":196371,"id":"CVE-2026-83991","ts":1789383754614,"field":"exploit_available","old":"true","new":"false"},{"seq":195299,"id":"CVE-2026-83991","ts":1789380567409,"field":"exploit_available","old":"false","new":"true"},{"seq":194142,"id":"CVE-2026-83991","ts":1789378754302,"field":"exploit_available","old":"true","new":"false"},{"seq":192929,"id":"CVE-2026-83991","ts":1789376505607,"field":"exploit_available","old":"false","new":"true"},{"seq":191716,"id":"CVE-2026-83991","ts":1789373609629,"field":"exploit_available","old":"true","new":"false"},{"seq":190501,"id":"CVE-2026-83991","ts":1789369461463,"field":"exploit_available","old":"false","new":"true"},{"seq":189288,"id":"CVE-2026-83991","ts":1789368388260,"field":"exploit_available","old":"true","new":"false"},{"seq":188071,"id":"CVE-2026-83991","ts":1789365226093,"field":"exploit_available","old":"false","new":"true"},{"seq":186858,"id":"CVE-2026-83991","ts":1789363465576,"field":"exploit_available","old":"true","new":"false"},{"seq":185644,"id":"CVE-2026-83991","ts":1789361213778,"field":"exploit_available","old":"false","new":"true"},{"seq":184431,"id":"CVE-2026-83991","ts":1789358340455,"field":"exploit_available","old":"true","new":"false"},{"seq":182682,"id":"CVE-2026-83991","ts":1789354312089,"field":"exploit_available","old":"false","new":"true"},{"seq":181475,"id":"CVE-2026-83991","ts":1789353310336,"field":"exploit_available","old":"true","new":"false"},{"seq":180268,"id":"CVE-2026-83991","ts":1789350274514,"field":"exploit_available","old":"false","new":"true"},{"seq":179061,"id":"CVE-2026-83991","ts":1789348271273,"field":"exploit_available","old":"true","new":"false"},{"seq":177854,"id":"CVE-2026-83991","ts":1789346364148,"field":"exploit_available","old":"false","new":"true"},{"seq":176647,"id":"CVE-2026-83991","ts":1789343170471,"field":"exploit_available","old":"true","new":"false"},{"seq":174764,"id":"CVE-2026-83991","ts":1789334871341,"field":"exploit_available","old":"false","new":"true"},{"seq":173559,"id":"CVE-2026-83991","ts":1789333675887,"field":"exploit_available","old":"true","new":"false"},{"seq":172373,"id":"CVE-2026-83991","ts":1789331088235,"field":"exploit_available","old":"false","new":"true"},{"seq":171187,"id":"CVE-2026-83991","ts":1789328763261,"field":"exploit_available","old":"true","new":"false"},{"seq":169982,"id":"CVE-2026-83991","ts":1789327157873,"field":"exploit_available","old":"false","new":"true"},{"seq":168777,"id":"CVE-2026-83991","ts":1789323823313,"field":"exploit_available","old":"true","new":"false"},{"seq":167572,"id":"CVE-2026-83991","ts":1789319679502,"field":"exploit_available","old":"false","new":"true"},{"seq":166367,"id":"CVE-2026-83991","ts":1789318752339,"field":"exploit_available","old":"true","new":"false"},{"seq":165162,"id":"CVE-2026-83991","ts":1789315784226,"field":"exploit_available","old":"false","new":"true"},{"seq":163957,"id":"CVE-2026-83991","ts":1789313615064,"field":"exploit_available","old":"true","new":"false"},{"seq":162752,"id":"CVE-2026-83991","ts":1789311897976,"field":"exploit_available","old":"false","new":"true"},{"seq":161547,"id":"CVE-2026-83991","ts":1789308709407,"field":"exploit_available","old":"true","new":"false"},{"seq":159660,"id":"CVE-2026-83991","ts":1789300463771,"field":"exploit_available","old":"false","new":"true"},{"seq":158825,"id":"CVE-2026-83991","ts":1789299571875,"field":"exploit_available","old":"true","new":"false"},{"seq":158285,"id":"CVE-2026-83991","ts":1789296689840,"field":"exploit_available","old":"false","new":"true"},{"seq":156649,"id":"CVE-2026-83991","ts":1789294748756,"field":"exploit_available","old":"true","new":"false"},{"seq":155444,"id":"CVE-2026-83991","ts":1789292958908,"field":"exploit_available","old":"false","new":"true"},{"seq":154239,"id":"CVE-2026-83991","ts":1789289789431,"field":"exploit_available","old":"true","new":"false"},{"seq":153663,"id":"CVE-2026-83991","ts":1789285353023,"field":"exploit_available","old":"false","new":"true"},{"seq":152529,"id":"CVE-2026-83991","ts":1789281257857,"field":"exploit_available","old":"true","new":"false"},{"seq":151490,"id":"CVE-2026-83991","ts":1789277620325,"field":"exploit_available","old":"false","new":"true"},{"seq":150451,"id":"CVE-2026-83991","ts":1789276232392,"field":"exploit_available","old":"true","new":"false"},{"seq":149418,"id":"CVE-2026-83991","ts":1789273818094,"field":"exploit_available","old":"false","new":"true"},{"seq":148385,"id":"CVE-2026-83991","ts":1789271330543,"field":"exploit_available","old":"true","new":"false"},{"seq":146416,"id":"CVE-2026-83991","ts":1789269380879,"field":"exploit_available","old":"false","new":"true"},{"seq":145222,"id":"CVE-2026-83991","ts":1789266334837,"field":"exploit_available","old":"true","new":"false"},{"seq":144126,"id":"CVE-2026-83991","ts":1789262600538,"field":"exploit_available","old":"false","new":"true"},{"seq":143030,"id":"CVE-2026-83991","ts":1789261515479,"field":"exploit_available","old":"true","new":"false"}]}