Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Azure File Sync v22 by Microsoft
CVE-2026-118288 (GCVE-0-2026-118288)
Vulnerability from nvd – Published: 2026-11-10 18:24 – Updated: 2026-11-11 17:19
VLAI
EPSS
VEX
Title
Microsoft Azure File Sync Elevation of Privilege Vulnerability
Summary
Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 19:38 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Azure File Sync |
Affected:
23.1.0.0 , < 23.2
(custom)
|
|
| Microsoft | Azure File Sync |
Affected:
1.0.0 , < 23.2
(custom)
|
|
| Microsoft | Azure File Sync v22 |
Affected:
1.0.0.0 , < 23.2
(custom)
|
Date Public
2026-11-10 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T19:38:58.332767Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T19:48:55.474Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Azure File Sync",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.2",
"status": "affected",
"version": "23.1.0.0",
"versionType": "custom"
}
]
},
{
"product": "Azure File Sync",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.2",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Azure File Sync v22",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.2",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_file_sync:*:*:*:*:*:*:*:*",
"versionEndExcluding": "23.2",
"versionStartIncluding": "23.1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_file_sync:*:*:*:*:*:*:*:*",
"versionEndExcluding": "23.2",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_file_sync_v22:*:*:*:*:*:*:*:*",
"versionEndExcluding": "23.2",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-11-10T16:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T17:19:51.683Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Azure File Sync Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118288"
}
],
"title": "Microsoft Azure File Sync Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-118288",
"datePublished": "2026-11-10T18:24:14.589Z",
"dateReserved": "2026-10-27T21:05:24.656Z",
"dateUpdated": "2026-11-11T17:19:51.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118288 (GCVE-0-2026-118288)
Vulnerability from cvelistv5 – Published: 2026-11-10 18:24 – Updated: 2026-11-11 17:19
VLAI
EPSS
VEX
Title
Microsoft Azure File Sync Elevation of Privilege Vulnerability
Summary
Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 19:38 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Azure File Sync |
Affected:
23.1.0.0 , < 23.2
(custom)
|
|
| Microsoft | Azure File Sync |
Affected:
1.0.0 , < 23.2
(custom)
|
|
| Microsoft | Azure File Sync v22 |
Affected:
1.0.0.0 , < 23.2
(custom)
|
Date Public
2026-11-10 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T19:38:58.332767Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T19:48:55.474Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Azure File Sync",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.2",
"status": "affected",
"version": "23.1.0.0",
"versionType": "custom"
}
]
},
{
"product": "Azure File Sync",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.2",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Azure File Sync v22",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.2",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_file_sync:*:*:*:*:*:*:*:*",
"versionEndExcluding": "23.2",
"versionStartIncluding": "23.1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_file_sync:*:*:*:*:*:*:*:*",
"versionEndExcluding": "23.2",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_file_sync_v22:*:*:*:*:*:*:*:*",
"versionEndExcluding": "23.2",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-11-10T16:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T17:19:51.683Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Azure File Sync Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118288"
}
],
"title": "Microsoft Azure File Sync Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-118288",
"datePublished": "2026-11-10T18:24:14.589Z",
"dateReserved": "2026-10-27T21:05:24.656Z",
"dateUpdated": "2026-11-11T17:19:51.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}