#windows
4 posts tagged #windows.
CVE-2026-73014 (PLUSONE): Reading Another User’s Files Through the Windows Data Sharing Service
A standard user gets the contents of a file its own permissions deny, because another user who also could not read it added them to a sharing token.
CVE-2026-18759: Privilege Escalation in ASUSTOR Backup Plan
ASUSTOR Backup Plan’s Windows service ABP_VSS_Service treats encryption as authentication and checks paths with a substring test. Standard user to SYSTEM.
Claude Cowork Boots Its Sandbox From a Folder You Can Rewrite
Cowork boots a Hyper-V VM from user-writable AppData with no hash or signature check. Replace the initrd; SYSTEM boots it. Anthropic: by design.
RogueProvision: A SYSTEM Task That Applies Unsigned Provisioning Packages (admin to SYSTEM, declined by MSRC)
A SYSTEM service applies unsigned .ppkg packages from a folder with no signature and no consent. Microsoft’s docs promise otherwise. Honest catch: admin→SYSTEM.