Server-side request forgery in Conductor OSS through 3.32.5 allows unauthenticated remote attackers to force the server to fetch attacker-controlled URLs through the A2A Agent Card Fetching endpoint when the AI/a2a feature is enabled and reachable. The vulnerable path is A2AService.getAgentCard, where the agentUrl argument can be manipulated to reach internal services; publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is indicated. The independent assessment rates this as moderate with low confidentiality, integrity, and availability impact, and exploitation is realistic only where the A2A agent-card functionality is exposed.
Local tampering with Windows Security Account Manager (SAM) data is possible on unpatched Windows hosts because a critical SAM function performs no authentication or authorization check, letting an authenticated local user modify integrity-sensitive account information. Exploitation requires a pre-existing local session (AV:L, PR:L) and affects only integrity (C:N/A:N), so the practical impact is moderate rather than catastrophic, and no public exploit identified at time of analysis - SSVC rates exploitation as none and automatable as no. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022/2025 (including Server Core), all of which have vendor fixes available.
Security feature bypass in the Windows AppX Deployment Service lets a locally authenticated attacker with low privileges circumvent a deployment-related protection by abusing an alternate path, undermining system integrity while leaving confidentiality and availability unaffected. Exploitation requires a pre-existing local foothold on the host - there is no remote vector and no user interaction - giving a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Neither confirmed active exploitation (CISA KEV) nor publicly available exploit code exists, and Microsoft has released a vendor fix covering the listed Windows 10, Windows 11, and Windows Server builds.
Information disclosure in Windows Health and Optimized Experiences Service on Windows 11 allows a locally authenticated low-privileged attacker to read sensitive data from the service because a critical function lacks proper authentication (CWE-306). The issue is local-only, requires an existing low-privileged session, and has low attack complexity but no user interaction; it does not permit privilege escalation or modification, and no public exploit has been identified at time of analysis. Microsoft has released a vendor patch, and this is a moderate, low-priority issue rather than an urgent threat.
Information disclosure in the Windows Broadcast DVR User Service (BcastDVRUserService) allows an attacker with local access and low-level authenticated privileges to read information they are not authorized to see on affected Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019 hosts. Tracked as CWE-862 (missing authorization) with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw is not remotely reachable and requires an existing foothold on the target machine, with confidentiality the only impacted property and no effect on integrity or availability. No public exploit code has been identified at time of analysis, and the CISA SSVC assessment records exploitation as 'none' and automatable as 'no', making this a moderate, low-priority issue despite affecting a ubiquitous platform; vendor patches are available.
Information disclosure in Microsoft Windows NTFS lets an attacker who already holds low-privileged local access on a target machine bypass access control checks and read file data they are not authorized to view (CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no ability to modify data or cause a denial of service. The local-access prerequisite is the key limiting factor - there is no remote or network-facing attack path, and no user interaction is required once a foothold exists, so this is a post-compromise privilege-escalation-of-information concern rather than an entry point. No public exploit code or confirmed active exploitation was identified at the time of analysis (CISA SSVC: Exploitation none, Automatable no), and the vendor has released patches, making this a moderate-priority patch-and-move-on item - not an emergency - for environments that cannot already be reached by a local standard user.
A locally triggered NULL pointer dereference in the Windows Hyper-V virtual switch (VMSwitch) lets an authenticated low-privilege user crash the host's virtual networking component, causing a denial of service (CVSS 5.6, AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H); confidentiality and integrity are unaffected. Only Windows systems with the Hyper-V role and virtual switching enabled are exposed, and successful triggering depends on a specific timing/state condition (AC:H), which keeps practical exploitation difficult; there is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with no automatable path. Although the vulnerable component is broad (Windows Server 2019 through 2025, Server Core, Windows 10 21H2/22H2/1809, and Windows 11 23H2 through 26H2 per the advisory), this is a moderate-severity, low-priority availability defect rather than an urgent threat.
An out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated, low-privileged local attacker to disclose sensitive information from the affected host. Only systems running vulnerable builds of Windows 10, Windows 11, and their corresponding Windows Server editions are affected, and exploitation requires that the attacker already holds a local interactive session on the target machine (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 5.5). There is no remote attack path: per CISA's SSVC decision framework, exploitation is assessed as none and the vulnerability is not automatable, and no public exploit code has been identified at time of analysis; the confidentiality-only impact and the local-vector prerequisite keep this a moderate-priority issue, most relevant on shared, multi-user, or Remote Desktop hosts where untrusted users can obtain local sessions.
Local information disclosure in the Microsoft Windows Servicing Stack (the component that installs and maintains Windows Updates) allows an authenticated attacker who already holds a low-privileged local foothold to trigger an out-of-bounds memory read and leak contents of process memory. Tracked as CVE-2026-83719 with a CVSS 3.1 base score of 5.5 (AV:L/PR:L/UI:N, C:H/I:N/A:N, CWE-126), it affects a broad set of supported Windows 10, Windows 11 and Windows Server builds, and Microsoft has published a vendor-released fix. Exploitation is assessed as not active and not automatable (CISA SSVC: exploitation none, automatable no), no public exploit code has been identified at time of analysis, and because the impact is confined to confidentiality and requires pre-existing local credentials, real-world severity is moderate and low priority.
An out-of-bounds read in the Windows WLAN Service lets a locally authenticated attacker disclose information from the host's memory on affected Windows 10, Windows 11 and Windows Server builds. Exploitation requires the attacker to already hold a low-privileged interactive logon or to run code under an existing user token on the target host (CVSS AV:L, PR:L); the issue is not remotely or anonymously reachable, no user interaction is needed (UI:N), and impact is limited to confidentiality (C:H with I:N/A:N), so there is no code execution or system modification. Severity is CVSS 5.5 (MEDIUM), CISA SSVC records Exploitation: none and Automatable: no, and there is no public exploit identified at time of analysis; a vendor patch is available and the signal set is consistent with a moderate, low-priority hardening item.
Local information disclosure in the Windows Portable Device (WPD) File System driver affects Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 hosts that have not installed the corresponding cumulative update. A type-confusion flaw (CWE-843) lets an attacker who already holds an authenticated, low-privileged local session (CVSS AV:L/PR:L, no user interaction) coerce the driver into treating one object type as another and read memory the caller should not be able to access, yielding high confidentiality impact but no integrity or availability impact (C:H/I:N/A:N). There is no network vector, no public exploit identified at time of analysis, and CISA SSVC rates the issue non-automatable with only partial technical impact, so it is best treated as a moderate-priority local information-leak primitive to be fixed on a normal patch cycle rather than as an emergency.
Information disclosure in the Windows Win32 Kernel Subsystem (CVE-2026-70288) allows an authenticated local attacker holding low privileges to read kernel-managed information belonging to other security contexts by winning a time-of-check time-of-use race. Every Windows client and server build below the patched levels published by Microsoft is affected, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1, and Windows Server 2012 through Server 2025. No public exploit has been identified at time of analysis, the flaw is not listed in CISA KEV, and CISA's SSVC decision framework rates exploitation as none, automatable as no, and technical impact as partial, making this a moderate-severity, low-priority issue in practice despite NVD's CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Ivanti Xtraction Cloud Sync before 2026.4 can expose partial SQL database passwords to an authenticated low-privileged user with local access to the application log. The authoritative assessment rates this CWE-532 information disclosure as AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating local access, low privileges, and limited confidentiality impact because only partial passwords are logged rather than full credentials; no public exploit was identified at time of analysis. This is a moderate-severity, low-priority issue rather than an urgent threat, and it is fixed in version 2026.4.
Local privilege-based security-feature bypass in the Windows Update Orchestrator Service (UsoSvc): an attacker who already holds a foothold and at least low-level user privileges on an affected Windows host can present hard-coded credentials to defeat a protection mechanism of the service. Because the hard-coded secret is embedded in the component rather than derived per-install, any local user who can invoke the service can reuse it, with the resulting impact limited to integrity (CVSS 5.5, AV:L/PR:L/UI:N, C:N/I:H/A:N) - no confidentiality loss or denial of service. All supported Windows client and server branches below their respective patched builds are affected, including Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2022 and Windows Server 2025; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited, and Microsoft has released patched builds.
Insufficiently granular access control in the Windows Mobile Device Management (MDM) component allows an authorized, locally present low-privileged user to tamper with MDM-managed state on the host, yielding high integrity impact with no confidentiality or availability impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 below the vendor-patched build numbers, and the gap is only meaningful where the MDM subsystem is enrolled or in use; a valid local standard-user account is a hard prerequisite. No public exploit code or active exploitation has been identified - CISA's SSVC assessment records Exploitation: none and Automatable: no - so this is a moderate-severity, low-priority issue in practice.
Local tampering in the Windows AppX Deployment Service allows an already-authenticated, low-privileged user to perform packaging and deployment operations that the service is supposed to restrict, weakening the integrity of installed app packages on the host. Affected platforms are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025, including Server Core installations, and exploitation requires an existing local foothold with low-level user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5). There is no public exploit code and no confirmed active exploitation - CISA SSVC records Exploitation=none and Automatable=no - so this is a medium-severity post-compromise integrity issue rather than a remotely reachable or self-propagating threat; Microsoft has published fixed builds for all affected branches.
Local tampering in Microsoft Windows SmartScreen allows an authenticated, low-privileged attacker who already holds a session on the host to invoke a critical SmartScreen function that is missing an authentication check (CWE-306) and abuse it to alter protected state, yielding a high integrity impact while confidentiality and availability are unaffected. Exploitation requires local access and prior authentication (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5), with no remote or unauthenticated path, and CISA's SSVC assessment records Exploitation: none and Automatable: no, which supports treating this as a moderate-priority hardening issue rather than an emergency. There is no public exploit identified at time of analysis and no confirmation of active exploitation; vendor-released patches are available for all listed Windows builds.
Information disclosure in the Microsoft Bluetooth Driver allows a locally authenticated attacker with low-level privileges to trigger an out-of-bounds memory read and obtain sensitive data from the affected Windows host. The issue spans an unusually broad servicing footprint covering Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations, and is scored CVSS 5.5 with high confidentiality impact but no integrity or availability impact. There is no public exploit identified at time of analysis and no evidence of active exploitation (CISA SSVC exploitation: none), so this rates as a moderate-severity, low-priority hardening item rather than an emergency; Microsoft has already published fixed builds, so remediation is a routine servicing update applied to the Bluetooth driver stack.
An out-of-bounds read in the Windows NTFS file system driver (ntfs.sys) lets an authenticated local user with low privileges read memory contents beyond an allocated buffer, resulting in local information disclosure (CWE-125, CVSS 3.1 5.5). Only hosts that have not applied Microsoft's current cumulative updates are affected; the EUVD data lists a broad range of client and server branches below their respective fixed builds (?fix versions include Windows 11 23H2 10.0.22631.7652, 24H2 10.0.26100.9711, 25H2 10.0.26200.9711, Windows 10 1607/Server 2016 10.0.14393.9612, and Windows 10 1809/Server 2019 10.0.17763.9376). There is no remote vector and CISA SSVC rates the flaw as non-automatable with only partial technical impact, and no public exploit code has been identified at time of analysis, so this is a genuine but low-priority disclosure primitive rather than a path to privilege escalation.
Local authenticated attackers holding only low-level user privileges on a Windows host can cause the Device Association Service to misinterpret a resource's type (CWE-843 type confusion) and thereby leak sensitive information from the affected system. The flaw carries a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it cannot be triggered remotely or by an unauthenticated user and does not by itself yield code execution, tampering, or denial of service, and there is no public exploit identified at time of analysis. Microsoft has shipped vendor fixes, and CISA's SSVC assessment records exploitation as none and the issue as non-automatable, so this is a moderate-priority patching and hardening item rather than an urgent, actively exploited threat.
An out-of-bounds read in the WebDAV functionality of Microsoft Windows allows a locally authenticated, low-privileged attacker to read memory contents and disclose information; exploitation requires existing local access to the host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), with no user interaction and low complexity. Affected systems span Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core installations, per the EUVD-listed build ranges. There is no CISA KEV entry and no public exploit identified at time of analysis (SSVC: Exploitation none, Automatable no), so this is a moderate, not urgent, priority best characterized as a post-compromise or malicious-insider information-disclosure aid rather than an initial-access vector.
Information disclosure in the Windows Event Log service allows an authenticated local attacker to read potentially sensitive memory contents. Affecting a broad range of Windows 10, 11, and Server editions, this low-severity flaw requires prior local access and only results in confidentiality impact, with no code execution or privilege escalation. No public exploit identified at time of analysis, and Microsoft has released patches.
An out-of-bounds read in the Windows Remote Access Service Infrastructure lets an attacker who already holds a low-privilege local session on the host read beyond the bounds of an allocated buffer and disclose information from process memory. Exploitation requires both local access (AV:L) and an authenticated low-privilege context (PR:L) per the assessed CVSS vector, with no network-facing or unauthenticated path, and CISA's SSVC assessment marks it non-automatable with only partial technical impact, so this is a moderate-severity disclosure issue rather than a top-tier emergency. No public exploit code has been identified at time of analysis, though the affected component ships across an unusually broad footprint: Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core installations.
Information disclosure in the Windows Print Spooler on affected client and server editions lets an authenticated local user obtain uninitialized memory contents from spooler components, potentially exposing residual sensitive data held by a privileged process. The flaw is rated 5.5 (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning exploitation is strictly local, requires a valid low-privileged account with local code execution or session access, needs no user interaction, and cannot be triggered remotely or by an unauthenticated attacker. Exploitation against CVE-2026-85320 is not currently observed, no public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none, so exposure is concentrated in shared multi-user hosts such as RDP servers, terminal servers and jump boxes; Microsoft has released patches.
Local tampering of Microsoft PowerToys installations is possible for an authenticated, low-privileged Windows user on versions 0.1 through builds below 0.101.2632.0, because a weak authentication mechanism (CWE-1390) can be bypassed to modify PowerToys-controlled state. The attack vector is strictly local (AV:L) and requires existing credentials (PR:L), so there is no remote or network path to exploitation, and impact is limited to integrity (I:H) with no confidentiality or availability loss. Microsoft has released a fix, and no public exploit identified at time of analysis. Per the independent assessment this is a moderate-severity, low-priority issue in practical terms.
An out-of-bounds read (CWE-125) in Microsoft Digest Authentication on unpatched Windows client and server builds lets an authenticated local user disclose information from the host; the CVSS 3.1 vector (AV:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the attacker must already hold low-level privileges on the machine, needs no user interaction, and can only read data - with no impact on integrity or availability. Because reachability is local rather than remote, the component is the Windows Digest/SASL authentication provider itself, and exploitation is limited to memory disclosure on systems that have not yet installed the vendor fixes identified by EUVD build numbers. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and SSVC assesses the issue as not automatable with no observed exploitation, so it should be treated as a low-to-moderate-priority hardening item rather than an emergency.
An out-of-bounds read in the Windows HID Parser Library allows an attacker who already holds a valid local session on an affected Windows host to disclose memory contents by supplying crafted or malformed HID descriptor data (for example via an emulated or malicious USB/Bluetooth HID device, or a local process feeding HID input). Exploitation requires local access and low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in information disclosure only - no code execution, integrity, or availability impact - and no public exploit was identified at time of analysis, with CISA's SSVC rating exploitation as none and the flaw as non-automatable. Microsoft has released patched builds for all affected Windows 10, Windows 11, and Windows Server editions, so this is a moderate, not urgent, priority that is resolved by applying current cumulative updates.
Tampering with Windows DNS Server configuration or data is possible for an authenticated local attacker on affected Windows Server and Windows 10 builds because of missing authorization checks (CWE-862). Affected systems must be running the DNS Server role, and exploitation only compromises integrity (no confidentiality or availability impact). Microsoft has released vendor patches; CISA SSVC rates exploitation as none, the issue is not automatable, and no public exploit is identified at time of analysis.
Local tampering with Windows Modern Device Management (MDM) is possible for an authenticated low-privileged attacker on affected Windows builds, allowing modification of MDM-related state or policy with high integrity impact but no confidentiality or availability impact. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms local access, low complexity, low privileges, no user interaction, and a medium 5.5 score; SSVC rates exploitation as none and non-automatable, and no public exploit has been identified at time of analysis. Vendor patches are available per Microsoft advisory, and affected platforms include Windows 10, Windows 11, and Windows Server releases listed in the Microsoft update guide.
Improper access control in the Windows Routing and Remote Access Service (RRAS) allows an authenticated local attacker holding only low-level privileges to tamper with service state or configuration on affected Windows 10, Windows 11, and Windows Server builds. Exploitation is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), requires the optional RRAS role to be installed and enabled, and impacts integrity only - confidentiality and availability are unaffected, which is consistent with the moderate 5.5 base score. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV), and vendor-released patches are available for every affected build branch.
Missing authorization in the Windows Overlay Filter (WOF) allows an authenticated local attacker to tamper with protected file/overlay data on affected Windows 10, Windows 11, and Windows Server 2016-2025 systems, producing an integrity-only impact (CVSS 5.5, CWE-862). The assessed vector (AV:L/PR:L/UI:N, C:N/I:H/A:N) means exploitation is neither remote nor unauthenticated: an attacker must already hold low-privileged local execution on the host, which confines real-world exposure to post-compromise and malicious-insider scenarios rather than a pre-auth or network attack. CISA SSVC records exploitation as "none" and no public exploit code has been identified at time of analysis; vendor patches are available from Microsoft, and this is a moderate-severity, low-urgency issue rather than an emergency.
Local tampering of network list data in the Windows Network List Service allows an authenticated low-privileged attacker to modify network profiles and settings, resulting in partial integrity impact while confidentiality and availability remain unaffected. Affected versions span Windows 10, Windows 11, and numerous Windows Server releases, with vendor patches available. No public exploit identified at time of analysis, and given the required local access and lack of remote vector, the risk is assessed as a moderate, low-priority integrity issue.
Improper authorization in the Windows Encrypting File System (EFS) lets an already-logged-in local user tamper with protected data that they should not be permitted to modify, yielding a high integrity impact with no confidentiality or availability impact (CVSS 5.5, AV:L/PR:L/UI:N, C:N/I:H/A:N). Only Windows 10, Windows 11, and Windows Server hosts that have not yet applied the current cumulative updates are exposed; the attack is strictly local, requires an interactive session and at least low-level privileges, and there is no public exploit identified at time of analysis (no CISA KEV entry, SSVC exploitation: none, EPSS not notable). This is a genuinely moderate, low-urgency issue rather than a high-priority emergency: vendor patches already exist for every affected build, so exposure is limited to unpatched systems where a low-privileged local user could subvert EFS authorization checks.
Improper authorization logic in the Windows SMB Client lets an authenticated local user bypass a Windows security feature, yielding a high-integrity impact on the affected system (CVE-2026-84011, CVSS 5.5). Exploitation requires an attacker to already hold valid low-privileged credentials and local code execution on the host (CVSS vector AV:L/PR:L/UI:N), so this is a post-compromise privilege-context escalation rather than a remotely reachable flaw; no confidentiality or availability impact is assessed. There is no public exploit identified at time of analysis and CISA SSVC rates exploitation as "none" with the issue considered non-automatable; Microsoft has released fixed builds for all affected Windows 11 and Windows Server 2022/2025 editions.
A locally authenticated, low-privileged attacker can bypass a security feature on Windows DHCP Server hosts by supplying data the service fails to properly authenticate, yielding a high integrity impact with no confidentiality or availability loss (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5). Exposure is limited to machines actually running the DHCP Server role - Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core) plus Windows 10 1607 and 1809 - and only those builds below the fixed revisions (for example Server 2025 < 10.0.26100.33650, Server 2022 < 10.0.20348.5761, Server 2019/Windows 10 1809 < 10.0.17763.9376, Server 2016/Windows 10 1607 < 10.0.14393.9612, Server 2012 R2 < 6.3.9600.23470, Server 2012 < 6.2.9200.26434). Microsoft has released patched builds; no public exploit code and no confirmed active exploitation are identified at time of analysis, and the practical risk driver is unpatched DHCP servers on which untrusted local users already have interactive access.
Spoofing of Windows Event Tracing (ETW) telemetry on affected Windows 11 and Windows Server 2025 hosts allows a locally authenticated, low-privileged attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) to falsify event data, undermining the integrity of logs and monitoring without reading protected data or causing denial of service. Only hosts below the vendor's fixed builds are impacted - Windows 11 24H2/25H2 (10.0.26100.9711 / 10.0.26200.9711), Windows 11 26H1 (10.0.28000.3231), Windows 11 26H2 (10.0.26300.9711) and Windows Server 2025 including Server Core (10.0.26100.33650) - and exploitation additionally requires an attacker to already hold a valid low-privileged local account, so realistic exposure is largely insiders or intruders who have already obtained a foothold. There is no public exploit identified at time of analysis; SSVC rates exploitation as 'none' and automatable as 'no', and vendor patches are available.
Incorrect authorization in the Microsoft Windows DNS Server role allows a locally authenticated attacker with low privileges to bypass a DNS security feature and alter DNS resolution behavior on the affected host. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning it cannot be triggered remotely or by an unauthenticated actor - the attacker must already hold a foothold on the server - and its impact is limited to integrity, with no confidentiality or availability loss and no user interaction required. All supported Windows Server generations that host the DNS Server role are affected, from Windows Server 2012 through Windows Server 2025, along with the Windows 10 1607 and 1809 clients that ship the same DNS components; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' (technical impact: partial), and no public exploit code was identified at time of analysis, so this is a genuine but moderate-priority hardening issue rather than an emergency.
Missing authorization checks in the Windows Server DNS Server role allow a locally authenticated, low-privileged attacker to tamper with DNS data or configuration, earning a CVSS 5.5 rating (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). The flaw (CWE-862) affects Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installation variants, with integrity-only impact and no data disclosure or denial-of-service component. Microsoft has released a vendor patch per the MSRC update guide, and CISA's SSVC assessment records no known exploitation with no public exploit identified at time of analysis; because exploitation requires existing local credentials on the DNS server, real-world urgency is moderate rather than critical.
Incorrect authorization in the Windows DNS Server role allows an attacker who already holds a low-privileged local account or interactive logon session on the DNS host to tamper with DNS data or service configuration, degrading integrity with no confidentiality or availability impact. Affected systems span Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) plus Windows 10 versions 1607 and 1809, in each case below the vendor's patched build numbers. Microsoft has released a fix, and no public exploit code has been identified at time of analysis; the SSVC assessment records exploitation as 'none', automatable as 'no' and technical impact as 'partial', so this is a genuine but moderate-priority issue rather than a top-tier emergency.
Incorrect authorization in Windows Routing and Remote Access Service (RRAS) lets a locally authenticated low-privileged attacker bypass a security feature, producing a high integrity impact (I:H) with no confidentiality or availability effect (CVSS 5.5, AV:L/PR:L/UI:N). The issue affects Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched versions and requires the RRAS role to be present, making it a post-compromise security-feature bypass rather than an initial-access path. No public exploit was identified at time of analysis (SSVC exploitation: none), and vendor patches are available.
Missing authorization checks in the Windows Server DNS Server role allow a locally authenticated, low-privileged user to tamper with DNS configuration or zone data on affected hosts, yielding a high-integrity impact with no confidentiality or availability effect. Exploitation is constrained: the attacker must already hold local access to a server running the DNS Server role (Windows Server 2012 through 2025, including Server Core installations), and the issue cannot be triggered remotely or by an unauthenticated user. Microsoft has released vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis; at CVSS 5.5 this is a moderate-severity integrity flaw whose practical risk is dominated by the prior-access requirement.
Local information disclosure in the Windows Clipboard User Service allows an attacker who already holds an authenticated, low-privileged logon session on a Windows host to read clipboard data that should not be accessible to that user. Because the vector is AV:L/PR:L with UI:N, the flaw cannot be triggered remotely or by an unauthenticated party - the attacker must first establish a foothold on the machine - and the sole impact is confidentiality loss, with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; CISA's SSVC assessment rates exploitation likelihood as none and the issue is not automatable, which keeps near-term risk moderate.
Local information disclosure in Windows Error Reporting (WER) allows an authenticated low-privileged attacker with an existing session on a Windows host to read report data that should be restricted from their privilege level, rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) under CWE-862 missing authorization. The impact is confidentiality-only: no data is modified and availability is unaffected, and because the vector is local there is no network path to exploit it, so the attacker must first hold valid low-privileged credentials or a running session on the machine. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', but vendor patches are available for the affected Windows 10 (1809/21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2019/2022/2025 builds listed in EUVD-2026-99319.
Information disclosure in the Microsoft Windows Notification component allows a locally authenticated, low-privileged user to read information outside their intended authorization boundary. The underlying weakness is improper/missing access control (CWE-306), exploitable only by an attacker who already holds interactive local access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with impact confined to confidentiality (C:H) and no integrity or availability effect and no privilege escalation. This is a moderate-severity issue (CVSS 5.5) that is not known to be actively exploited and for which no public exploit code was identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none', the attack as non-automatable, and technical impact as partial, while Microsoft has published vendor patches fixing the affected builds.
Opening a crafted document in Adobe FrameMaker 2026 (versions up to and including 18.0.0.206) or Adobe FrameMaker 2022 (versions up to and including 17.0.9.866) can trigger an out-of-bounds read that discloses sensitive contents of the application's memory. The flaw requires no privileges or authentication from the attacker (PR:N) and is delivered as a local file that the victim must open (AV:L/UI:R), so exploitation depends on user interaction with attacker-controlled content rather than any network-reachable or service-side trigger; confidentiality impact is rated High while integrity and availability are unaffected (CVSS 5.5). No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), so this is a moderate-severity, low-urgency information-disclosure flaw that fits normal patch-cycle urgency rather than emergency response.
Tampering of Windows Host Guardian Service (HGS) configuration and attestation-related data is possible for an authenticated local attacker on hosts where the HGS role is deployed, yielding high integrity impact with no loss of confidentiality or availability. Rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) under CWE-250, this is a moderate-severity, low-priority issue rather than an urgent threat: Microsoft has released patched builds, no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework records Exploitation: none and Automatable: no. Exposure is narrow, confined to guarded-fabric/shielded-VM environments where the HGS server role is installed rather than to general Windows installations.
LDAP injection in Esri Portal for ArcGIS allows an authenticated administrator to tamper with directory search queries built by administrative functionality, causing unintended Active Directory or LDAP operations against the connected directory service. The flaw is network-reachable with low complexity and requires no user interaction, but it is gated behind high administrative privileges (PR:H) and only materializes when the portal is configured to integrate with an external AD/LDAP identity store. Impact is weighted toward information disclosure (C:H) with limited integrity effects (I:L) and no availability impact; no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) activity. Overall this is a moderate-severity, operationally-constrained issue rather than a top-tier emergency.
Improper verification of cryptographic signatures in the Windows DNS Server component lets an authenticated, low-privileged attacker who already has local access to the host tamper with data that the service is supposed to validate, with the impact confined to integrity (no loss of confidentiality or availability). Exploitation is local only (AV:L, PR:L, UI:N) and requires a signature-validating configuration to be in use for the tampering to have meaning, so this is a moderate, non-urgent issue rather than a remotely reachable emergency. No public exploit code exists and there is no evidence of active exploitation, and CISA's SSVC assessment records Exploitation as none and Automatable as no; Microsoft has published patched builds that resolve the flaw.
Arbitrary file write via path traversal in Adobe Content Credentials SDK components (the c2patool CLI, the c2pa Rust SDK, and the @contentauth/c2pa-web JavaScript SDK) allows an attacker to write files outside intended directories by supplying a maliciously crafted C2PA asset that a victim extracts. The attack is local (AV:L) and requires user interaction (UI:R)-the victim must actively open or extract the crafted file-while no attacker authentication is required (PR:N). Severity is moderate (CVSS 5.5) with integrity-only impact, and no public exploit identified at time of analysis.
Spoofing of update content in the Windows Update Stack on Windows 10, Windows 11, and Windows Server allows a locally authenticated attacker (AV:L, PR:L) to bypass cryptographic signature verification and modify update artifacts, yielding integrity impact (CVSS 5.5). Vendor-released cumulative updates fix the flaw; no public exploit code or active exploitation has been identified at time of analysis.