Windows Server 2012 CVE-2026-26152

Local user account required. Windows Cryptographic Services storing sensitive keys/credentials in insufficiently protected storage locations (non-encrypted registry hives or world-readable file permissions). Requires ability to access local filesystem or registry with user privileges.

Real-world risk is moderate despite the 7.0 CVSS score. The local attack vector (AV:L) limits exposure to scenarios where attackers already have authenticated access to target systems, reducing the attack surface compared to network-exploitable vulnerabilities. High attack complexity (AC:H) indicates exploitation is non-trivial and may require race conditions, specific timing, or particular system configurations. The PR:L requirement means attackers need existing low-privilege credentials, positioning this as a second-stage attack in a compromise chain rather than an initial access vector. With vendor patches available across all affected Windows versions and no public exploit identified at time of analysis, organizations with regular patching cadences face manageable risk. However, the broad platform coverage (Windows 10/11 and Server 2012-2025) creates significant exposure surface in enterprise environments. The cryptographic services component is fundamental to Windows security architecture, making successful exploitation particularly impactful for lateral movement and persistence. Priority should be elevated in environments with untrusted local users, shared workstations, or where privilege separation is a critical control, but remains lower than actively exploited remote code execution vulnerabilities.

An authorized local user discovers plaintext or weakly encrypted cryptographic material in Windows Crypto Services storage. They extract the credentials and use them to impersonate higher-privileged accounts, bypassing access controls to gain system-level code execution capabilities.