Bypass Record
Exploitation for Priv-Esc × Microsoft Windows Cloud Filter driver (cldflt.sys)
A publicly-reported instance of Exploitation for Priv-Esc bypassing Microsoft Windows Cloud Filter driver (cldflt.sys), recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The vulnerability is a regression in the Cloud Filter driver that enables a local attacker to exploit a previously patched flaw to escalate privileges to SYSTEM. It defeats the original patch, allowing privilege escalation on fully updated systems.
Detection & mitigation
Monitor for unexpected SYSTEM-level processes spawned from low-integrity or user-mode processes, especially those interacting with cldflt.sys. Apply the latest security patches from Microsoft as soon as they are available to remediate the regression.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.