Windows Common Log File System Driver Elevation of Privilege Vulnerability

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• microsoft windows server 2012all versions
• microsoft windows server 2012r2
• microsoft windows server 2016before 10.0.14393.9339
• microsoft windows server 2019before 10.0.17763.9020
• microsoft windows server 2022before 10.0.20348.5386
• microsoft windows server 2025before 10.0.26100.33158

Versions reported by the vendor

Affected version ranges reported by the assigning authority (microsoft). Independent of NVD's CPE analysis and usually ahead of it.

• Microsoft Windows 10 Version 1607

  • 10.0.14393.0 and later · before 10.0.14393.9339affected

• Microsoft Windows 10 Version 1809

  • 10.0.17763.0 and later · before 10.0.17763.9020affected

• Microsoft Windows 10 Version 21H2

  • 10.0.19044.0 and later · before 10.0.19044.7548affected

• Microsoft Windows 10 Version 22H2

  • 10.0.19045.0 and later · before 10.0.19045.7548affected

• Microsoft Windows 11 Version 24H2

  • 10.0.26100.0 and later · before 10.0.26100.8875affected

• Microsoft Windows 11 Version 25H2

  • 10.0.26200.0 and later · before 10.0.26200.8875affected

• Microsoft Windows 11 version 26H1

  • 10.0.28000.0 and later · before 10.0.28000.2525affected

• Microsoft Windows Server 2012

  • 6.2.9200.0 and later · before 6.2.9200.26226affected

• Microsoft Windows Server 2012 (Server Core installation)

  • 6.2.9200.0 and later · before 6.2.9200.26226affected

• Microsoft Windows Server 2012 R2

  • 6.3.9600.0 and later · before 6.3.9600.23291affected

• Microsoft Windows Server 2012 R2 (Server Core installation)

  • 6.3.9600.0 and later · before 6.3.9600.23291affected

• Microsoft Windows Server 2016

  • 10.0.14393.0 and later · before 10.0.14393.9339affected

Other highest-scoring records for the same primary product.

• CVE-2018-8174A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine RemKEV
  86Now
• CVE-2022-44698Windows SmartScreen Security Feature Bypass VulnerabilityKEV
  74This week
• CVE-2026-21510Windows Shell Security Feature Bypass VulnerabilityKEV
  72This week

Published before and after this one in the same product

• ← EarlierCVE-2026-50694Jul 14, 2026 · Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
  39Monitor
• ← EarlierCVE-2026-50695Jul 14, 2026 · Windows Active Directory Federation Services Denial of Service Vulnerability
  30Monitor
• Later →CVE-2026-54107Jul 14, 2026 · Windows Win32k Elevation of Privilege Vulnerability
  28Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.