CVE-2026-118288: Microsoft Azure File Sync Elevation of Privilege Vulnerability
CVE-2026-118288 is an elevation of privilege vulnerability in Microsoft Azure File Sync, rated Important by Microsoft, with a CVSS 3.1 base score of 7 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday. It affects 3 products in 2 product families (Azure, Apps).
Key facts
- CVE ID
- CVE-2026-118288
- Severity
- High CVSS 7
- Microsoft severity
- Important
- Impact
- Elevation of Privilege
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-732
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- November 2026 Patch Tuesday
- Product families
- Azure, Apps
CVSS score and vector
Microsoft scores CVE-2026-118288 at 7 (temporal 6.1) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Local |
| Attack complexity | High |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally.
Frequently asked questions (Microsoft)
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation requires an administrator to have previously performed an affected repair operation on the server.
Affected products (3)
Azure
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Azure File Sync v23 | Release Notes | Security Update | 23.2 | No |
| Azure File Sync v21 |
Apps
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Azure File Sync v22 |
NIST NVD data
- NVD status
- Awaiting Analysis
- NVD CVSS
- 7 (HIGH)
- NVD weakness
- CWE-732
- Published to NVD
- NVD last modified
References
Acknowledgments
- Jianyang Song
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |