Incorrect permission assignment for critical resource in Azure File Sync - CVE-2026-118288
Published: November 11, 2026
Vulnerability identifier: #VU165084
CSH Severity: Low
CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118288
CWE-ID: CWE-732
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges to SYSTEM.
The vulnerability exists due to incorrect permission assignment for a critical resource in Azure File Sync when accessing that resource locally. A local user can exploit the incorrectly assigned permissions to gain SYSTEM privileges.
Successful exploitation requires an administrator to have previously performed an affected repair operation on the server.
Affected software
Azure File Sync
How to mitigate CVE-2026-118288
Install security update from vendor's website.
Azure File Sync - update to 23.2