{"id":"CVE-2023-28252","published":"2023-04-11T21:15:25Z","modified":"2026-06-17T05:47:14Z","title":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"Windows Common Log File System Driver Elevation of Privilege Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an elevation of privilege vulnerability in the Common Log File System (CLFS) driver, a component of Microsoft Windows, caused by out-of-bounds write and heap-based buffer overflow weaknesses. An attacker with local access and low-privileged credentials, requiring no user interaction, could exploit it to gain elevated privileges on the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:59:18Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.48892,"percentile":0.98875,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-04-11","dueDate":"2023-05-02","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-28252;  https://nvd.nist.gov/vuln/detail/CVE-2023-28252","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-04-11","exploitedFirstSeen":"2023-04-11","ransomware":true,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2023-Apr","date":"2023-04-11"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2023-04-11"},{"url":"https://securelist.com/nokoyawa-ransomware-attacks-with-windows-zero-day/109483/","date":"2023-04-11"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-04-11"},{"url":"https://decoded.avast.io/threatresearch/avast-q1-2023-threat-report/","date":"2023-05-04"},{"url":"https://securelist.com/it-threat-evolution-q2-2023-non-mobile-statistics/110413/","date":"2023-08-30"},{"url":"https://securelist.com/it-threat-evolution-q2-2023/110355/","date":"2023-08-30"},{"url":"https://blog.sekoia.io/sekoia-io-mid-2023-ransomware-threat-landscape","date":"2023-09-14"},{"url":"https://securelist.com/windows-clfs-exploits-ransomware-cve-2023-28252/111601/","date":"2023-12-21"},{"url":"https://securelist.com/windows-clfs-exploits-ransomware/111560/","date":"2023-12-21"}],"evidenceTotal":25,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28252","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/174668/Windows-Common-Log-File-System-Driver-clfs.sys-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28252","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28252","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. \n\nThis CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an \"ESX Admins\" group to encrypt the ESXi file system and disrupt hosted VMs.","confidence":"high"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. \n\nThis CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an \"ESX Admins\" group to encrypt the ESXi file system and disrupt hosted VMs.\n\nBased on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:","confidence":"high"},{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. \n\nThis CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an \"ESX Admins\" group to encrypt the ESXi file system and disrupt hosted VMs.\n\nBased on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:","confidence":"high"},{"id":"T1021","name":"Remote Services","tactics":["lateral-movement"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. \n\nThis CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an \"ESX Admins\" group to encrypt the ESXi file system and disrupt hosted VMs.\n\nBased on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. \n\nThis CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an \"ESX Admins\" group to encrypt the ESXi file system and disrupt hosted VMs.\n\nBased on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:","confidence":"high"},{"id":"T1136","name":"Create Account","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. \n\nThis CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an \"ESX Admins\" group to encrypt the ESXi file system and disrupt hosted VMs.\n\nBased on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:","confidence":"high"},{"id":"T1486","name":"Data Encrypted for Impact","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. \n\nThis CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an \"ESX Admins\" group to encrypt the ESXi file system and disrupt hosted VMs.\n\nBased on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-31960","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-31960","exploited":true,"exploitedSince":"2023-04-11","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":1,"earliest":"2023-06-27","earliestUrl":"https://github.com/fortra/CVE-2023-28252","repos":[{"name":"fortra/CVE-2023-28252","url":"https://github.com/fortra/CVE-2023-28252","stars":184,"created":"2023-06-27"},{"name":"duck-sec/CVE-2023-28252-Compiled-exe","url":"https://github.com/duck-sec/CVE-2023-28252-Compiled-exe","stars":57,"created":"2024-01-22"},{"name":"byt3n33dl3/CLFS","url":"https://github.com/byt3n33dl3/CLFS","stars":6,"created":"2024-03-21"},{"name":"bkstephen/Compiled-PoC-Binary-For-CVE-2023-28252","url":"https://github.com/bkstephen/Compiled-PoC-Binary-For-CVE-2023-28252","stars":5,"created":"2024-01-01"},{"name":"Danasuley/CVE-2023-28252-","url":"https://github.com/Danasuley/CVE-2023-28252-","stars":0,"created":"2023-11-13"}]},"metasploit":[{"name":"Windows Common Log File System Driver (clfs.sys) Elevation of Privilege Vulnerability","module":"exploit/windows/local/cve_2023_28252_clfs_driver","type":"exploit","disclosureDate":"2023-04-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2023_28252_clfs_driver.rb"}],"first":{"date":"2023-04-11","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2023_28252_clfs_driver.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/174668/Windows-Common-Log-File-System-Driver-clfs.sys-Privilege-Escalation.html"],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"source"},{"stage":"primary","techniques":["T1068"],"provenance":"source"},{"stage":"secondary","techniques":["T1059","T1136","T1003","T1021","T1486"],"provenance":"source"}],"timeline":[{"date":"2023-04-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28252","provenance":"source"},{"date":"2023-04-11","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-06-27","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2023_28252_clfs_driver.rb","provenance":"source"},{"date":"2023-04-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2023-Apr","provenance":"source"},{"date":"2023-04-11","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-04-11","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-31960","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":0},"priority":{"score":78.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1297 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.77,"detail":"percentile 0.9888"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 6 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-787"}}