Microsoft reports active exploitation of a Windows CLFS zero-day (CVE-2025-29824) to escalate privileges and deploy ransomware. Learn about the attacks, the threat actors involved, and how to mitigate the risk.

CISA has added critical vulnerabilities affecting Windows CLFS (CVE-2025-29824) and Gladinet CentreStack (CVE-2025-30406) to its Known Exploited Vulnerabilities Catalog. Learn about the threats and the urgent need to apply patches.Sources and related content

A zero-day privilege escalation vulnerability (CVE-2025-29824) in Microsoft CLFS was exploited by Balloonfly (Play ransomware) before the official patch.

A Windows CLFS zero-day (CVE-2025-29824) actively exploited by RansomEXX and Play ransomware gangs for privilege escalation, with a public PoC. Patch now!

CISA warns that an old Windows CLFS flaw (CVE-2021-43226) is being actively exploited again, allowing local attackers to escalate privileges for full system takeover.