Windows Server 2016 CVE-2026-26170

Local system access with valid user credentials. PowerShell execution must be enabled. No special PowerShell profile or module configuration required — standard Windows PowerShell installations are vulnerable.

This vulnerability presents a significant real-world privilege escalation risk in enterprise environments. The CVSS v3.1 score of 7.8 (High) accurately reflects serious impact across confidentiality, integrity, and availability (C:H/I:H/A:H), though practical exploitation requires local access and low-level authentication (AV:L/PR:L). The attack complexity is low (AC:L) with no user interaction required (UI:N), meaning any standard user who has already gained foothold access can reliably escalate privileges without social engineering or complex prerequisites. From an SSVC perspective, this represents a moderate-to-high priority: while no active exploitation is confirmed and no public exploit code exists, the technical impact enables full system compromise and the attack is highly automatable once initial access is obtained. The unchanged scope (S:U) limits blast radius to the compromised system, reducing risk compared to network-propagating vulnerabilities. Patch availability from Microsoft mitigates urgency for organizations with robust patch management, but the broad affected surface (Windows 10/11 and all current Server versions) creates substantial exposure windows during deployment cycles. Organizations should prioritize patching for systems where standard users have PowerShell access, particularly jump servers, developer workstations, and administrative systems where attackers commonly seek privilege escalation post-initial-compromise.

An authorized local user crafts a malicious PowerShell command with improper input that bypasses validation checks. Upon execution, the attacker escalates from standard user privileges to SYSTEM level, gaining full system control.