CVE-2025-32706 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2025-05-13

Added to CISA KEV: 2025-05-13 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for unusual privilege escalations, check for unauthorized administrative access, verify system integrity and audit local user accounts
Apply Microsoft security updates immediately to patch the CLFS driver vulnerability
Monitor for unusual local privilege escalation attempts and administrative account activity
Patch priority: HIGH for all Windows systems, especially those that may be targets for multi-stage attacks

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2025-32706 is a security vulnerability in the Windows Common Log File System (CLFS) driver that was disclosed and patched by Microsoft in May 2025 ^[1].

The following details summarize what is known about this vulnerability:

Active Exploitation and Threat Actor Usage

Active Exploitation: CVE-2025-32706 was actively exploited in the wild as a zero-day vulnerability prior to its disclosure and the release of patches ^[1].
CISA Catalog: Due to evidence of active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog ^[3].

Attack Method and Exploitation Requirements

Vulnerability Type: The issue is caused by improper input validation within the Windows Common Log File System (CLFS) driver ^[2].
Attack Vector: This is a local vulnerability. It requires the attacker to already have authorized access to the system to execute the exploit ^[2].
User Interaction: As an elevation of privilege vulnerability, it typically does not require user interaction to succeed once the attacker has established a foothold on the target machine.

Impact

Access/Impact: Successful exploitation allows an attacker to elevate their privileges on the affected system ^[2]. This effectively allows a low-privileged user to gain higher-level permissions (such as SYSTEM-level access), which is a common step in post-exploitation activities to maintain persistence, bypass security controls, or move laterally within a network.

Affected Products and Mitigation

Affected Versions: The vulnerability affected fully supported versions of Windows, including Windows 10, Windows 11, and Windows Server ^[4].
Patch Status: Microsoft addressed this vulnerability in the May 2025 Patch Tuesday security updates ^[1]. Users and administrators are advised to ensure that all systems are updated with the latest security patches to mitigate this risk.

*Note: While specific details regarding the exact threat actors or specific ransomware campaigns using this exploit are often limited in public disclosures, its inclusion in the CISA KEV catalog confirms that it has been utilized in real-world attacks.*

Sources

Microsoft’s May 2025 Patch Tuesday Addresses 71
CVE-2025-30385, CVE-2025-32701 and CVE-2025-32706 | Windows Common Log File System Driver Elevation of Privilege Vulnerabilities ... CVE-2025-30385 , CVE-2025-32701 and CVE-2025-32706 are EoP vulnerabilities in the Windows Common Log File System (CLFS) Driver. ... Both CVE-2025-32701 and CVE-2025-32…
CVE-2025-32706 Detail - NVD
Description. Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. Metrics. CVSS ...
NVD - CVE-2025-32706
Secure .gov websites use HTTPS A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites. ... Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.CV…
CVE-2025-33072 - Exploits & Severity - Feedly
NVD published the first details for CVE-2025-33072 ... Feedly estimated the CVSS as MEDIUM based on the CVE details, attack complexity, and exploit information. ... Two of the most severe zero-days this month are tied to the Windows Common Log File System (CLFS) driver -- CVE- 2025-32701 and CVE-202…

🟢 CVE-2025-32706