CVE-2026-35603 and ProgramData config trust: one local user can plant hooks for every Claude Code, Cursor, Codex CLI and Gemini CLI user on a Windows machine

What happened

Cymulate Research Lab found the same flaw in four AI coding tools on Windows. Each one reads a system-wide config file from a folder under C:\ProgramData. None of them created that folder at install time or restricted who could write to it, and the Users group can create subfolders in ProgramData by default. The tools also did not check who owned the file before loading it, and they apply it to every user on the machine (Cymulate).

A low-privileged local user can therefore create the folder, drop a config file, and wait. The next user who starts the tool runs the attacker’s command with their own rights. The file and the command it runs differ per tool (Cymulate):

Cymulate reported to Anthropic on 5 January 2026, to Cursor on 12 January and to OpenAI through Bugcrowd on 16 February. It reported to Google through the Cloud VRP but gives no date (Cymulate).

Only Anthropic’s tool has a CVE. CVE-2026-35603 covers Claude Code before 2.1.75 on Windows. It is rated CVSS v4.0 5.4 (moderate), CWE-426, and was published on 17 April 2026. Exploitation needs a shared multi-user Windows system and a victim who starts Claude Code after the file is planted (GitHub advisory; CVE record). Anthropic moved managed settings to a write-protected Program Files location and emailed affected enterprise customers first (Cymulate). The current file path is C:\Program Files\ClaudeCode\managed-settings.json, and Claude Code no longer reads the old ProgramData path (Claude Code docs).

Am I affected?

You are at risk if more than one person (or a service account plus a person) logs on to the same Windows machine and any of these tools is installed. Single-user laptops are not the target of this bug.

# Claude Code version (fixed in 2.1.75)
claude --version
npm ls -g @anthropic-ai/claude-code

# Other tools (no fixed version published)
codex --version
gemini --version
cursor --version

# Do the folders exist, and who owns them and can write to them?
Get-ChildItem C:\ProgramData\ClaudeCode, C:\ProgramData\Cursor, C:\ProgramData\openai\codex, C:\ProgramData\gemini-cli -Force -ErrorAction SilentlyContinue
icacls C:\ProgramData\Cursor
icacls C:\ProgramData\openai\codex
icacls C:\ProgramData\gemini-cli

Any of these files that you did not deploy is suspect: C:\ProgramData\ClaudeCode\managed-settings.json, C:\ProgramData\Cursor\hooks.json, C:\ProgramData\openai\codex\config.toml and C:\ProgramData\gemini-cli\system-defaults.json. Read them for hooks, notify, danger-full-access and approval_policy entries. If the folder owner is a normal user account, or icacls shows BUILTIN\Users with write or create rights, any local user can plant a file there.

What to do now

1. Update Claude Code to 2.1.75 or later. Auto-update users already have it; manual installs need npm install -g @anthropic-ai/claude-code@latest or your package manager’s equivalent (GitHub advisory).
2. Move Claude Code policy to the new path. If you deployed managed settings to C:\ProgramData\ClaudeCode\, redeploy them to C:\Program Files\ClaudeCode\managed-settings.json. Updated Claude Code ignores the old file, so a policy left there is no longer enforced (Claude Code docs).
3. Pre-create and lock the other three folders. As an administrator, create C:\ProgramData\Cursor, C:\ProgramData\openai\codex and C:\ProgramData\gemini-cli, make Administrators the owner, and remove write and create rights for Users. Push this with Group Policy or your configuration tool so it holds on every shared machine. Cymulate lists this as the main organizational mitigation (Cymulate).
4. Alert on writes to the four files. Send file-creation events for the paths above to your SIEM, and alert when a non-admin account creates one. Also watch for child processes started by the AI tool processes (Cymulate).
5. Remove files you did not deploy, then check what their hooks or notify commands ran. A planted command runs as whoever started the tool, so look at that user’s activity since the file’s creation time.
6. Do not run these tools from administrator accounts on shared machines. A planted hook gets the rights of the user who triggers it.

Why this matters

The fix for Claude Code is a path change. An organization that pushed managed-settings.json to C:\ProgramData\ClaudeCode\ before the update now has a policy file that updated clients silently ignore. Check that your Windows policy lives in C:\Program Files\ClaudeCode\ and that /status shows it loading.

Sources

• Cymulate: CVE-2026-35603, privilege escalation in AI coding tools
• GitHub advisory GHSA-5cwg-9f6j-9jvx: Claude Code, CVE-2026-35603
• CVE record: CVE-2026-35603
• Claude Code docs: deploy managed settings