Windows Server 2016 CVE-2026-26163

Local authenticated user account required on Windows system with kernel double-free vulnerability enabled. Attacker must have PR:L (low-privilege user) logon capability to trigger the vulnerable kernel code path.

Real-world risk is moderately high but conditional on attacker having initial access. The CVSS 7.8 score reflects complete compromise potential (C:H/I:H/A:H) but is constrained by local attack vector (AV:L) requiring authenticated access (PR:L). Attack complexity is low (AC:L) with no user interaction required (UI:N), meaning exploitation is straightforward once an attacker has local credentials. No EPSS score provided, but the combination of local-only access requirement and lack of public exploit code reduces immediate internet-scale risk. However, the vulnerability becomes critical in multi-stage attack scenarios where adversaries leverage it post-initial-compromise (via phishing, stolen credentials, or supply chain) to escalate from standard user to SYSTEM. The extensive affected product list including current Windows 11 26H1 and Server 2025 builds means organizations running latest versions remain vulnerable until patching. Microsoft's patch availability mitigates risk for organizations with robust patch management, but the vulnerability's presence across both legacy (Server 2012 R2) and current systems creates extended exposure windows in heterogeneous environments. SSVC assessment: Exploitation status is none (no KEV, no public POC), but technical impact is total (kernel privilege escalation), and the vulnerability is likely automatable given low complexity, elevating priority for systems with high-value assets or limited network segmentation.

An attacker who has gained initial access to a Windows environment through phishing or credential compromise authenticates to a target workstation or server with a standard user account. The attacker executes a custom exploit targeting the Windows Kernel double