Windows Server 2019 CVE-2026-26184

Local system access with standard user privileges. Windows Projected File System (ProjFS) must be installed and active. Attacker requires ability to execute code in user context on the target system.

Real-world risk is moderate-high for enterprise environments with standard user deployments. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) reveals an authenticated local attacker with low privileges can reliably exploit this without user interaction or complex preconditions, achieving complete confidentiality, integrity, and availability impact. However, the local attack vector constrains exploitation to scenarios where attackers already have initial system access through compromised credentials, insider threats, or chained with remote code execution. No CISA KEV listing exists and no public exploit identified at time of analysis, reducing immediate weaponization risk. EPSS data not provided but typical privilege escalation vulnerabilities in Windows kernel components show moderate exploitation probability once technical details surface. The straightforward attack complexity (AC:L) and kernel-space attack surface suggest exploit development is feasible for skilled attackers. SSVC decision factors indicate moderate urgency: exploitation status currently proof-of-concept level, technical impact enables total system control, automatable once exploit code exists. Priority increases substantially for organizations running multi-tenant systems, terminal servers, or environments where privilege separation is critical security boundary. The extensive version scope (14 distinct Windows versions) amplifies patch management burden and attack surface duration.

An attacker with valid low-privilege domain credentials on a Windows 11 corporate workstation executes a malicious application that triggers the ProjFS buffer over-read by crafting specific file virtualization requests targeting kernel memory boundaries. The memory disclosure leaks kernel security tokens and address space layout information, which the attacker leverages to achieve SYSTEM-level privileges, install persistent backdoors, disable endpoint detection tools, and move laterally across the Windows domain infrastructure.