CVE-2026-65680

The 6.7 CVSS score on this vulnerability hides a structurally dangerous pattern. The issue isn't a one-time privilege escalation—it's the creation of a persistent redirection channel that OneDrive will follow repeatedly on sync cycles, potentially with elevated privileges attached to the sync service account. A local attacker who plants a symlink in a OneDrive-monitored path isn't exploiting a transient race condition; they're establishing a durable bridge between low-privilege file operations and system-level access. The key insight defenders miss: OneDrive runs as a background service with its own access token and mediates file operations across user-space and system contexts. That means an attacker with a local foothold can redirect OneDrive's privileged writes to overwrite DLLs in system directories, poison config files in Program Files, or corrupt admin tools. The attack doesn't require chaining with another exploit—it just requires OneDrive to sync. Once the symlink is planted, every subsequent sync cycle is a potential privilege escalation event. What makes this class particularly dangerous is the temporal separation between the malicious action (symlink creation in user space) and the privileged effect (OneDrive writing to System32). Your EDR likely sees the symlink creation as a low-severity user-space operation and the OneDrive service writing to System32 as routine—whitelisted behavior. It never correlates them as a single attack chain. Organizations need detection rules that correlate symlink creation events in OneDrive-monitored paths with subsequent privileged writes by the sync service account, treating them as a unified attack chain. The compensating control that actually addresses the root cause is unglamorous but effective: restrict the OneDrive service account's write permissions to a narrow allowlist of paths, audited quarterly, with no exceptions for convenience. The organizations that get burned aren't the ones who haven't heard of least privilege—they're the ones who granted exceptions to make OneDrive work with legacy share mounts. The architectural question isn't whether OneDrive should follow symlinks; it's why a sync client needs write access to DLL directories and Program Files in the first place.

Reviewed through automated stages and approved by a human before publication.