SB2026111140 - Incorrect permission assignment for critical resource in Azure File Sync

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-118288)

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to incorrect permission assignment for a critical resource in Azure File Sync when accessing that resource locally. A local user can exploit the incorrectly assigned permissions to gain SYSTEM privileges.

Successful exploitation requires an administrator to have previously performed an affected repair operation on the server.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118288
• https://support.microsoft.com/en-us/servicing/azure/file-sync/update/2026/azure-file-sync-agent-v23-2-november