{"id":"CVE-2026-118288","aliases":[],"cve":{"records":[{"id":"CVE-2026-118288","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-27T21:05:24.656Z","published":"2026-11-10T18:24:14.589Z","modified":"2026-11-13T18:12:56.237Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-11-13T18:12:56.237Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T19:48:55.474Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118288","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-732","description":"CWE-732: Incorrect Permission Assignment for Critical Resource","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_file_sync:*:*:*:*:*:*:*:*","versionStartIncluding":"23.1.0.0","versionEndExcluding":"23.2"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_file_sync:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"23.2"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_file_sync_v22:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0.0","versionEndExcluding":"23.2"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T19:38:58.332767Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Microsoft Azure File Sync Elevation of Privilege Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally.","score":7,"severity":"high","published":"2026-11-10T18:24:14.589Z","modified":"2026-11-13T18:12:56.237Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Azure File Sync","platforms":[],"versions":[{"version":"23.1.0.0","status":"affected","lessThan":"23.2","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-118288"},{"vendor":"Microsoft","name":"Azure File Sync","platforms":[],"versions":[{"version":"1.0.0","status":"affected","lessThan":"23.2","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-118288"},{"vendor":"Microsoft","name":"Azure File Sync v22","platforms":["x64-based Systems"],"versions":[{"version":"1.0.0.0","status":"affected","lessThan":"23.2","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-118288"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118288"],"sources":[{"name":"CVE","id":"CVE-2026-118288","modified":"2026-11-13T18:12:56.237Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118288"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","score":7}],"sourceAffected":[],"observedAt":"2026-11-13T19:39:19.533Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-11T17:45:37.082Z","attemptedAt":"2026-11-11T17:45:37.082Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-11T17:45:37.202Z","attemptedAt":"2026-11-11T17:45:37.202Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-11T17:45:37.581Z","attemptedAt":"2026-11-11T17:45:37.581Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-11T17:45:37.143Z","attemptedAt":"2026-11-11T17:45:37.143Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-118288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118288","modified":"2026-11-10T20:18:18.963","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-11T17:45:37.082Z"},{"source":"GitHub Advisory Database","id":"GHSA-28fj-p3qr-478v","url":"https://github.com/advisories/GHSA-28fj-p3qr-478v","modified":"2026-11-10T21:33:10Z","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-11T17:45:37.202Z"},{"source":"ENISA EUVD","id":"EUVD-2026-122507","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-122507","modified":"Nov 11, 2026, 11:51:04 AM","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","checkedAt":"2026-11-11T17:45:37.581Z"}],"aiSummary":{"text":"Microsoft Azure File Sync versions 1.0.0, 1.0.0.0, and 23.1.0.0 have an elevation of privilege vulnerability due to incorrect permission assignment, allowing an authorized attacker to elevate privileges locally. The vulnerability is caused by CWE-732: Incorrect Permission Assignment for Critical Resource. Affected versions are less than 23.2.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-11T02:26:17.732Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118288"}]}}