CVE-2023-28252

An unpatched privilege escalation flaw in the Windows CLFS driver was actively exploited in the wild to enable ransomware attacks.

The CLFS driver vulnerability allowed attackers to escalate privileges on Windows systems, providing a foothold for ransomware deployment. DIB organizations must ensure all Windows patches are applied promptly, as unpatched known CVEs are a primary vector for supply-chain and ransomware incidents. This failure highlights the severe compliance and operational risks of running unpatched Microsoft products.

Shame score — A known, unpatched privilege escalation vulnerability was actively exploited in the wild to deploy ransomware, demonstrating severe negligence and avoidable risk.