Is CVE-2023-36036 (Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation) being exploited in the wild?

Yes. CISA added CVE-2023-36036 to its Known Exploited Vulnerabilities catalogue on 14 November 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.

What “exploited in the wild” means for this CVE

CISA’s inclusion of CVE-2023-36036 in the CISA Known Exploited Vulnerabilities Catalog is the clearest operational signal that the issue is not just theoretical. For defenders, that means the question is less “can it be exploited?” and more “where is it present, and how quickly can we reduce exposure?”

The practical implication is that this is a Windows privilege escalation issue that can elevate an attacker to SYSTEM on affected hosts. That changes triage priority because a foothold that would otherwise look limited can become full local control, with direct impact on persistence, defense evasion, and follow-on activity.

For background on how to structure that response, the Zero-Day and Exploited Vulnerabilities Guide covers the same operational pattern: confirm exposure, use KEV status to raise priority, and move quickly from identification to containment and remediation.

How to confirm whether you are exposed

Start by identifying every Windows system that could run the Cloud Files Mini Filter Driver component, then determine whether those systems are internet-facing, user-accessible, or privileged endpoints. If the vulnerability exists on a high-value workstation, server, or admin jump host, the practical risk is higher than on an isolated low-impact endpoint because local privilege escalation often becomes a stepping stone to broader compromise.

Do not treat “no obvious signs of compromise” as evidence of safety. Actively exploited flaws are often used opportunistically after initial access, so the real question is whether vulnerable systems are still reachable by an attacker who has already obtained a foothold.

Use the CVE Program and vendor guidance to confirm the exact record, then cross-check the NIST National Vulnerability Database for environment-specific inventory and reference data. That combination helps teams translate a named CVE into a concrete asset search.

What to do when patching is delayed

If immediate remediation is not possible, treat the affected host as a higher-risk privilege boundary. Limit who can log on locally, reduce the number of users with administrative rights, and isolate the system from unnecessary interactive access. The aim is not to “compensate” for the flaw perfectly, but to make post-exploitation movement harder and noisier.

When patching must wait, monitoring matters more than usual. Watch for suspicious child processes, unexpected privilege changes, new scheduled tasks, or signs that a low-privilege execution context suddenly gained SYSTEM-level capability. A privilege escalation exploit is especially dangerous when paired with credential dumping or service abuse.

Where you need a broader exploitation lens, MITRE ATT&CK Enterprise Matrix helps teams map local privilege escalation into the wider attack chain, including credential access and lateral movement that often follow a successful exploit.

Risk and Threat Considerations

Privilege escalation vulnerabilities are attractive because they convert a modest initial foothold into control that is much harder to contain. When the target is a Windows component, the attacker often needs only one usable foothold before attempting to move from a limited session to SYSTEM, which can undermine local controls, logging assumptions, and incident containment.

Failure mechanism: An attacker with some level of code execution or user access abuses the driver weakness to elevate privileges on the host, then uses the higher trust level to tamper with defenses, access protected material, or stage further movement.

Impact: Successful exploitation can turn a single compromised account or endpoint into a more serious compromise, including persistence, credential theft, and faster spread to adjacent systems if the host is trusted by other services.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	Prioritises hardening and reducing exploitability on Windows hosts.
	CIS-7 — Continuous Vulnerability Management	The question is about active exploitation and rapid remediation priority.
Recommendation — Harden affected Windows systems and remove unnecessary exposure paths that enable privilege escalation. Use continuous vulnerability management to find, rank, and remediate KEV-listed flaws quickly.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	Supports confirming exposure and tracking known exploited vulnerabilities.
	SI-2 — Flaw Remediation	Directly supports patching or mitigating an actively exploited software flaw.
	AU-6 — Audit Record Review, Analysis, and Reporting	Supports checking for earlier compromise after suspected exploitation.
Recommendation — Scan affected assets for the vulnerable component and track remediation to closure. Apply flaw remediation promptly on hosts running the vulnerable Windows component. Review audit records for signs the host was already used to gain SYSTEM-level access.

Practitioner Guidance

What to prioritise: Prioritise hosts where a local exploit would have the largest blast radius, especially admin workstations, jump hosts, and systems that already store or broker sensitive credentials. Those systems deserve faster remediation than ordinary user endpoints because privilege escalation there can cascade into broader compromise.

What to verify: Verify that the vulnerable component is actually present before closing the ticket, and confirm after remediation that the host no longer shows the vulnerable behavior or related suspicious activity. For exploitable Windows flaws, patch status alone is not enough if the system may already have been used as an entry point.

Practitioner takeaway: Once CISA places a Windows privilege-escalation CVE in KEV, treat it as an active defense problem, not a vulnerability-management backlog item, and combine rapid remediation with compromise checks on the systems that matter most.