Cloud-Files-Api — PoC Archivehttps://poc.intelseclab.com/tags/cloud-files-api/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000Microsoft Defender Link Following Local Privilege Escalation (CVE-2026-41091)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41091-defender-link-following-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41091-defender-link-following-lpe/High severity (CVSS 7.8) — binary · CVE-2026-41091. Status: Weaponized. Affects: Microsoft Defender / Microsoft Malware Protection Engine. Tags: windows, microsoft-defender, link-following, cwe-59, cloud-files-api, ntfs-junction, oplock, privilege-escalation, lpe.binaryHighwindowsmicrosoft-defenderlink-followingcwe-59cloud-files-apintfs-junctionoplockprivilege-escalationlpeRedSun Privileged File Write (CVE-2026-33825)https://poc.intelseclab.com/pocs/binary/2026-05-15_redsun-privileged-file-write/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-15_redsun-privileged-file-write/High severity (CVSS 7.8) — binary · CVE-2026-33825. Status: Weaponized. Affects: Microsoft Defender Antivirus (real-time protection) on Windows with Cloud Files APIs. Tags: LPE, privileged-file-write, Windows Defender, Cloud Files API, TOCTOU, file-reparse-point.binaryHighLPEprivileged-file-writeWindows DefenderCloud Files APITOCTOUfile-reparse-pointMiniPlasma - Windows Cloud Files Mini Filter Driver LPE (CVE-2020-17103)https://poc.intelseclab.com/pocs/binary/2026-05-15_miniplasma-cve-2020-17103/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-15_miniplasma-cve-2020-17103/High severity (CVSS 7.8) — binary · CVE-2020-17103. Status: Weaponized. Affects: Windows Cloud Files Mini Filter Driver (cldflt.sys) / cldapi.dll. Tags: LPE, Windows, cldflt.sys, Cloud Files API, registry-symlink, race-condition, WER-hijack, SYSTEM-shell, local-user.binaryHighLPEWindowscldflt.sysCloud Files APIregistry-symlinkrace-conditionWER-hijackSYSTEM-shelllocal-user