Microsoft has released a security fix for a privilege escalation vulnerability in the Windows Cloud Files Mini Filter driver, the kernel‑mode engine behind OneDrive’s on‑demand file placeholders and other cloud‑sync integrations. Tracked as CVE-2026-20857, the bug allows an attacker with limited local access—even a standard user account—to gain full SYSTEM control of an unpatched PC. The update is part of the company’s routine patch cycle and should be treated as urgent.

What the Patch Fixes

The faulty code lives in cldflt.sys, a driver that bridges user‑mode cloud sync clients (like OneDrive) and the Windows kernel. It handles placeholder files, reparse points, and a stream of input/output control calls (IOCTLs) that let apps ask the kernel to materialize or sync files. Because the driver runs with the highest system privileges, any memory‑safety glitch or logic mistake becomes a direct path to kernel‑mode code execution.

Microsoft’s advisory deliberately omits the low‑level exploit mechanics—standard practice for kernel bugs—but security researchers familiar with the component say the vulnerability likely falls into one of the recurring failure patterns seen in previous Cloud Files mini‑filter flaws:

  • Use‑after‑free (UAF) – a freed memory object is reused for an attacker‑controlled allocation, enabling arbitrary read/write primitives.
  • Out‑of‑bound (OOB) access – incorrect length checks allow reading or writing beyond a buffer, often leaking kernel pointers or corrupting adjacent memory.
  • Time‑of‑check/time‑of‑use (TOCTOU) races – the driver validates a file or metadata, then acts on it, but an attacker changes the state in between.

All of these can convert a local foothold into full SYSTEM compromise. The exact trigger remains private, but the operational impact is clear: patch now.

Real‑World Risks: Who’s in Danger

Home and everyday users. If you use OneDrive, or any third‑party sync tool that relies on the Cloud Files API, your PC is almost certainly running cldflt.sys. An attacker needs some way to execute code on your machine first—a malicious email attachment, a compromised installer, even a guest account—but once they do, this bug hands them the keys to the operating system. They could install rootkits, steal browser‑stored credentials, disable antivirus, or use the machine for deeper network attacks.

Businesses and IT administrators. Workstations, virtual desktops (VDI), terminal servers, and administrator jump boxes are particularly exposed. A successful escalation on one of these can lead to lateral movement across the domain. The attacker doesn’t need admin rights to start; any standard domain user profile is sufficient.

Developers and power users. Build servers, test environments, and developer laptops often run custom code with relaxed restrictions—perfect launchpads for local privilege exploits. If a developer’s machine is compromised, source code, signing certificates, and access tokens become prizes.

The Cloud Files Driver: A Tempting Target

The Cloud Files mini‑filter is one of those quiet Windows components that almost nobody knows exists—but it’s been a magnet for vulnerability research since its debut. Why? Because it sits at the exact boundary between untrusted user input and the trusted kernel. Every time OneDrive creates a placeholder file, the driver parses metadata and filesystem operations that originate from user mode. Complexity plus kernel context equals risk.

In the past eighteen months alone, Microsoft has patched multiple elevation‑of‑privilege bugs in cldflt.sys. Some were assigned CVE identifiers with high severity ratings; at least one was listed in CISA’s Known Exploited Vulnerabilities catalog, indicating real‑world abuse. This history matters: when a new Cloud Files CVE appears, defenders should assume the system is actively being targeted until proven otherwise.

A Chain of Kernel Flaws

The current CVE didn’t materialize in a vacuum. Since Windows 10 introduced deeper OneDrive and Projected File System (ProjFS) integration, the attack surface has expanded with every feature update. Researchers regularly find ways to trick the driver through crafted reparse points, manipulated placeholder metadata, or unexpected IOCTL calls. The patching treadmill is fast, but the fundamental challenge—auditing millions of lines of kernel code that handle complex, attacker‑controllable data—isn’t going away.

For CVE-2026-20857, Microsoft hasn’t said if the bug is being exploited in the wild. However, the company’s Security Update Guide typically adds an “Exploited: Yes” label when telemetry confirms active attacks. The absence of that label today shouldn’t reassure anyone; many kernel exploits are used in targeted campaigns that escape wide telemetry. Treat the patch as preventive and critical.

How to Protect Your System

For everyone: install the update

The single most effective action is to download and install the cumulative update that contains the fix. The specific KB number depends on your version of Windows (Windows 10, Windows 11, or Windows Server) and the update channel. Head to Settings > Windows Update, click Check for updates, and install any pending quality updates. After the reboot, you can verify the driver version with a quick PowerShell command to confirm the patched file is in place:

(Get-Item 'C:\Windows\System32\drivers\cldflt.sys').VersionInfo | Select FileVersion, ProductVersion

Compare the version against the list in the Microsoft Security Update Guide for your specific OS build. If the version matches the updated one, you’re protected.

For IT and system administrators

  • Use the official guide. Retrieve the exact KB→SKU mappings from the Microsoft Security Update Guide for CVE-2026-20857. This is the only authoritative source for matching patches to your Windows images. Deploy through your normal channels—WSUS, SCCM, Intune, or your patch management tool.
  • Prioritize. Focus first on administrative jump boxes, developer workstations, VDI hosts, and servers that accept remote logon sessions. Then roll out to all remaining endpoints.
  • Validate. After deployment, run the PowerShell command above on a sample of machines to confirm the driver version increments. Schedule required reboots and communicate them to end users.

If you cannot patch immediately

Sometimes testing or maintenance windows get in the way. While you arrange for the patch, these compensating controls lower the risk significantly:

  • Remove local admin rights from everyday user accounts. The exploit chain requires the ability to execute code, but removing admin reduces the number of surfaces an attacker can abuse.
  • Enforce application allowlisting. Windows Defender Application Control (WDAC) or AppLocker can prevent untrusted executables from running, cutting off the most common delivery mechanism for local privilege escalation tools.
  • Restrict cloud sync features on high‑risk hosts. If a machine doesn’t need OneDrive or third‑party cloud sync, disable the service or remove the sync client. That reduces exposure to bugs in cldflt.sys.
  • Isolate critical unpatched systems. Place them on a restricted network segment where possible. An attacker who escalates on one box shouldn’t be able to hop sideways.

Monitoring and detection

Even after patching, assume that some machines may have been compromised before the fix. Watch for these indicators:

  • Kernel crashes referencing cldflt.sys. Blue‑screen minidumps with stack traces pointing to the driver suggest someone may be fuzzing or exploiting the driver.
  • Unusual IOCTL activity. Endpoint detection tools can spot low‑privilege processes opening handles to cloud filter device objects or issuing unexpected control codes.
  • Unexpected SYSTEM‑level processes. If a process normally run by a standard user suddenly spawns as NT AUTHORITY\SYSTEM, investigate immediately.
  • Sudden modifications to startup folders or scheduled tasks. Post‑exploitation often creates persistence.

Building a Stronger Defense for the Future

Kernel‑mode drivers will remain a rich target, but Microsoft and hardware vendors are working on longer‑term containment. Virtualization‑based security (VBS) and hypervisor‑enforced code integrity (HVCI, also called memory integrity) can make entire classes of kernel exploits impractical. If your hardware supports it, enabling memory integrity in Windows Security > Device Security > Core isolation is one of the most impactful steps you can take.

Beyond that, applying patches quickly—especially for kernel components—and keeping a solid inventory of driver versions will be the foundation of defense. The Cloud Files mini‑filter isn’t going away, but every update shrinks the window where a local bug becomes a full‑system catastrophe.