Windows csc.sys: Information disclosure or elevation of privilege

Summary

The Windows Client Side Caching driver (csc.sys) contains a vulnerability that is described as an information disclosure in the NVD record, while Microsoft classifies it as an elevation of privilege. An attacker needs local access and valid logon credentials, so the threat is mainly a user or malware already on an endpoint. Microsoft rates the severity as Important and the CVSS score is 8.8; the sources disagree on the bug class and the attack vector, so the impact is not fully confirmed.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2012 and Server Core (6.2.9200.0 to before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core (6.3.9600.0 to before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612 (secondary source, not yet verified against the MSRC KB article)
• Windows 10 Version 1809: 10.0.17763.9376 (secondary source)
• Windows 10 Version 22H2: 10.0.19045.7807 (secondary source)
• Windows 11 Version 24H2: 10.0.26100.9711 (secondary source)
• Windows 10 Version 1809 and Server 2019 update: KB5126651 (October 2026, as listed by Tenable)
• No Knowledge Base number confirmed for Windows 10 Version 1607.

Workaround

Unknown. Microsoft has not confirmed a workaround. A third-party source states that disabling Client Side Caching or blocking csc.sys through system policy can mitigate the issue; this has not been tested or confirmed by Microsoft and can break Offline Files.

Exploitation

• Microsoft: not publicly disclosed, not exploited, exploit code maturity unproven.
• CISA SSVC: exploitation none, automatable no, technical impact total. Not listed in CISA KEV.
• EPSS score: 0.00837.
• No public proof of concept or in-the-wild exploitation found in the research.

Our recommendation

• Install the October 2026 security update for all affected Windows systems, and confirm the exact fixed build for your version with the MSRC advisory.
• Identify Windows 10 Version 1607 and other end-of-life systems; confirm whether they still receive security updates, and plan an upgrade if they do not.
• Prioritise shared and older workstations where many users log on.
• If patching is not possible, test the third-party mitigation in a pilot group before applying it to production.
• Monitor endpoints for unusual local activity, such as unexpected privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-70149 msrc.microsoft.com
• MSRC Security Update Guide (en-US): CVE-2026-70149 msrc.microsoft.com
• NVD record mirror via Vulners: CVE-2026-70149 vulners.com
• Microsoft CVE mirror via Vulners: CVE-2026-70149 vulners.com
• OpenCVE: CVE-2026-70149 app.opencve.io
• Strix: CVE-2026-70149 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:57.