{"id":"CVE-2026-118288","kind":"vulnerability","aliases":["CVE-2026-118288"],"related":[],"title":"Azure File Sync: permission flaw lets a local user gain higher privileges","description":"Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally.","summary":"Azure File Sync assigns permissions to a critical resource incorrectly, so an attacker who already has an authorized account can raise their privileges on the machine. The attack is local, and the sources do not describe any remote trigger.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Azure File Sync agent","fixed":["23.2.0.0"],"affected":"< 23.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["azure-file-sync","local-privilege-escalation","self-hosted","vendor","windows"],"not_affected_if":["agent-23.2-or-later","never-ran-fixafseventscorruption","no-azure-file-sync"],"how_to_check":"On each Windows server, check the Azure File Sync agent version (installed programs, or the StorageSyncAgent install folder); below 23.2.0.0 is in range. Then check whether anyone ran FixAfsEventsCorruption.ps1 or Debug-StorageSyncServer -FixAfsEventsCorruption: Microsoft says only that run introduces the bad permissions. Inspect the ACL on C:\\Program Files\\Azure\\StorageSyncAgent (default path) for all-users access.","fix":"Update the Azure File Sync agent to 23.2.0.0 (KB5072940) via Microsoft Update, AfsUpdater.exe or the installer; the update also corrects permissions on existing servers.","status":"open","published_at":"2026-11-10T19:19:42+00:00","first_seen_at":"2026-11-10T19:24:51+00:00","triaged_at":"2026-11-10T19:52:05+00:00","updated_at":"2026-11-10T23:15:46+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-10T19:52:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Azure File Sync: permission flaw lets a local user gain higher privileges","impact":"high","summary":"Azure File Sync assigns permissions to a critical resource incorrectly, so an attacker who already has an authorized account can raise their privileges on the machine. The attack is local, and the sources do not describe any remote trigger.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["azure-file-sync","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the server","analyst_note":"Find the vendor advisory for CVE-2026-118288 on the Microsoft Security Response Center to get affected and fixed versions and any setting to change.","how_to_check":"- Check whether Azure File Sync server agent is installed on the Windows servers you run.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-azure-file-sync"],"who_is_affected":"Teams that run Azure File Sync server endpoints on Windows and let more than one user log in locally. The sources do not state which versions are affected or which configurations are exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":4494,"output_tokens":454,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory for CVE-2026-118288 on the Microsoft Security Response Center to get affected and fixed versions and any setting to change.","search":"'-118288':15A,18A '-2026':14A,17A 'account':54B 'agent':22A 'allow':85C 'alreadi':50B 'assign':39B,77C 'attack':48B,63B,88C 'author':53B,87C 'azur':1A,24B,36B,82C 'azure':19A 'azure-file-sync':23B 'critic':43B,79C 'cve':13A,16A 'describ':71B 'elev':90C 'escal':30B 'file':2A,20A,25B,37B,83C 'flaw':5A 'gain':10A 'higher':11A 'host':33B 'incorrect':45B,75C 'let':6A 'local':8A,28B,65B,92C 'local-privilege-escal':27B 'machin':61B 'permiss':4A,40B,76C 'privileg':12A,29B,58B,91C 'rais':56B 'remot':73B 'resourc':44B,80C 'self':32B 'self-host':31B 'sourc':68B 'sync':3A,21A,26B,38B,84C 'trigger':74B 'user':9A 'vendor':34B 'window':35B","nicknames":[],"mitigations":[],"who_affected":"Windows servers running the Azure File Sync agent below 23.2.0.0 where the event manifest recovery script (FixAfsEventsCorruption.ps1) or the Debug-StorageSyncServer -FixAfsEventsCorruption cmdlet was run on demand. Microsoft says the bad permissions are not set during normal agent operation and most users do not run this, so they are not impacted. It is a local privilege escalation: the attacker needs a local account on the server.","tier":"B","verified":{"fix":{"at":"2026-11-10T23:15:46Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-release-notes","run_id":3128},"products":{"at":"2026-11-10T23:15:46Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-release-notes","run_id":3128},"how_to_check":{"at":"2026-11-10T23:15:46Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-release-notes","run_id":3128},"who_affected":{"at":"2026-11-10T23:15:46Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-release-notes","run_id":3128}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["azurefilesyncagent","filesyncagent"],"ptokens":["agent","azure","file","sync"],"labels":["azurefilesync","high","localprivilegeescalation","selfhosted","vendor","windows"],"campaign_type":null,"search_a":"'-118288':15A,18A '-2026':14A,17A 'agent':22A 'azur':1A 'azure':19A 'cve':13A,16A 'file':2A,20A 'flaw':5A 'gain':10A 'higher':11A 'let':6A 'local':8A 'permiss':4A 'privileg':12A 'sync':3A,21A 'user':9A","search_b":"'account':54B 'alreadi':50B 'assign':39B 'attack':48B,63B 'author':53B 'azur':24B,36B 'azure-file-sync':23B 'critic':43B 'describ':71B 'escal':30B 'file':25B,37B 'host':33B 'incorrect':45B 'local':28B,65B 'local-privilege-escal':27B 'machin':61B 'permiss':40B 'privileg':29B,58B 'rais':56B 'remot':73B 'resourc':44B 'self':32B 'self-host':31B 'sourc':68B 'sync':26B,38B 'trigger':74B 'vendor':34B 'window':35B","search_c":"'allow':85C 'assign':77C 'attack':88C 'author':87C 'azur':82C 'critic':79C 'elev':90C 'file':83C 'incorrect':75C 'local':92C 'permiss':76C 'privileg':91C 'resourc':80C 'sync':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118288","severity":null,"published_at":"2026-11-10T19:19:42+00:00","modified_at":"2026-11-10T19:19:42+00:00","first_seen_at":"2026-11-10T19:24:51+00:00","fetched_at":"2026-11-10T19:24:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118288:3128","url":"https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-release-notes","severity":null,"published_at":"2026-11-10T23:15:46+00:00","modified_at":"2026-11-10T23:15:46+00:00","first_seen_at":"2026-11-10T23:15:46+00:00","fetched_at":"2026-11-10T23:15:46+00:00","note":"Microsoft Learn release notes for agent 23.2.0.0 name this CVE: fixed in 23.2.0.0; permissions only wrong if FixAfsEventsCorruption.ps1 / Debug-StorageSyncServer -FixAfsEventsCorruption was run. MSRC page not retrievable; NVD/CNA ranges used for versions.","cites":["https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-release-notes","https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-release-notes","https://nvd.nist.gov/vuln/detail/cve-2026-118288"]}],"documents":[{"id":120095,"url":"https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-release-notes","title":"Release Notes for Azure File Sync (v23.2.0.0 security update)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":120095,"url":"https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-release-notes","title":"Release Notes for Azure File Sync (v23.2.0.0 security update)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120096,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-118288","title":"NVD CVE-2026-118288","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}