Windows Server 2016 CVE-2026-0390

This vulnerability presents moderate real-world risk with important contextual nuances. The CVSS 6.7 score reflects high impact (C:H/I:H/A:H) but is tempered by restrictive attack conditions: local-only access (AV:L) and high privileges already required (PR:H). The attack complexity is low (AC:L), meaning no special conditions are needed once access is obtained. The lack of user interaction (UI:N) indicates the attack executes automatically. While no EPSS probability score is provided, the combination of low attack complexity and high impact suggests meaningful exploitability for insider threats, compromised administrator accounts, or lateral movement scenarios. The KEV status is not reported as active, and no public exploit code is documented, reducing immediate threat likelihood. However, the authentication bypass tag and security feature bypass capability indicate this is not a low-severity issue-it directly enables privilege escalation or security control circumvention for those already on the system. Organizations with strong insider threat programs or multi-factor authentication for privileged accounts should prioritize patching based on deployment exposure (Windows 10 and Server versions are widespread). This is a priority issue for secure boot and firmware security postures, but not an emergency compared to remote, unauthenticated vulnerabilities.

An authorized system administrator or service account with local administrative access on a Windows 10 or Server system crafts a malicious input or modifies boot configuration parameters that the boot loader incorrectly trusts for security decisions (such as Secure Boot policy enforcement or driver verification). During the next system boot, the loader processes this untrusted input without proper validation, allowing the attacker to disable or bypass the intended security feature, potentially loading unsigned drivers or altering kernel protections that would otherwise restrict the attacker's capabilities.