« Volver al listado

CVE-2026-40058

Estado: Pendiente de análisisAlta (8.8)—

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings.

An update is available immediately for versions 7.34 and above, 7.32 LTS, and 7.16 for Windows 7/2008 R2 systems. The Falcon sensor for Mac, Linux, and Legacy Systems are not affected.

This vulnerability could expose an arbitrary file write to protected locations from an unprivileged context, potentially leading to local privilege escalation.

Leer descripción completaMostrar menos

The CrowdStrike Laroux Malware Cleanup Tool, based off of the same feature in the CrowdStrike Falcon sensor for Windows, is also affected. An update for this tool is also available immediately.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L + PR:L sin UI interacción indica escalada de privilegios local. CWE-367 (TOCTOU) + "arbitrary file write to protected locations" confirma T1548 (Abuse Elevation Control Mechanism). Manipulación de archivos del sistema es T1565.001.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict File and Directory PermissionsExecution PreventionUpdate SoftwareUser Account ManagementThreat Intelligence ProgramPrivileged Account Management

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Crowdstrike — Falcon SensorAICrowdstrike — Laroux Malware Cleanup ToolAIMicrosoft — OfficeAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-40058",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40058",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-15T18:04:32.076649Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
      "affectedData": [
        {
          "vendor": "CrowdStrike",
          "product": "Falcon sensor for Windows",
          "versions": [
            {
              "status": "affected",
              "version": "8.10.0",
              "lessThan": "8.10.21408",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "7.40.0",
              "lessThan": "7.40.21309",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "7.39.0",
              "lessThan": "7.39.21113",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "7.38.0",
              "lessThan": "7.38.21007",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "7.37.0",
              "lessThan": "7.37.20912",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "7.36.0",
              "lessThan": "7.36.20807",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "7.35.0",
              "lessThan": "7.35.20712",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "7.34.0",
              "lessThan": "7.34.20613",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "7.33.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "7.32.0",
              "lessThan": "7.32.20410",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "CrowdStrike",
          "product": "Falcon sensor for Windows",
          "versions": [
            {
              "status": "affected",
              "version": "7.16.0",
              "lessThan": "7.16.18644",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Windows 7",
            "Windows Server 2008"
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "CrowdStrike",
          "product": "Laroux Cleanup Tool",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.20",
              "lessThan": "1.4.70.0",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-09-15T18:17:20.913",
  "references": [
    {
      "url": "https://www.crowdstrike.com/en-us/security-advisories/cve-2026-40058/",
      "source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings.\n\n\n\n\nAn update is available immediately for versions 7.34 and above, 7.32 LTS, and 7.16 for Windows 7/2008 R2 systems. The Falcon sensor for Mac, Linux, and Legacy Systems are not affected. \n\n\n\n\nThis vulnerability could expose an arbitrary file write to protected locations from an unprivileged context, potentially leading to local privilege escalation.\n\n\n\n\nThe CrowdStrike Laroux Malware Cleanup Tool, based off of the same feature in the CrowdStrike Falcon sensor for Windows, is also affected. An update for this tool is also available immediately."
    }
  ],
  "lastModified": "2026-09-18T19:34:36.657",
  "sourceIdentifier": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661"
}