Windows Server 2012 CVE-2026-27914

Local system access with valid user credentials. Requires Interactive login capability on affected Windows system running vulnerable Microsoft Management Console (MMC) version. No special configurations needed—vulnerability exploitable on standard MMC installations with standard user or higher privileges.

Real-world risk is elevated despite no confirmed active exploitation. CVSS 7.8 accurately reflects high impact (complete confidentiality, integrity, availability compromise) with favorable attacker conditions: low attack complexity (AC:L) and only low privileges required (PR:L). Any domain user or local account can potentially exploit this without specialized knowledge. The local-only attack vector (AV:L) limits remote exploitation but does not significantly reduce risk in enterprise environments where attackers commonly achieve initial foothold through phishing or supply chain compromise, then pivot laterally using privilege escalation vulnerabilities like this. Absence of EPSS data and KEV listing suggests no public exploit at analysis time, but the authentication bypass tag and Microsoft's disclosure pattern indicate this vulnerability class has proven exploitable in past incidents. The ubiquitous deployment of MMC across all Windows endpoints and servers creates massive attack surface. Priority should be high for organizations with least-privilege enforcement gaps, especially where users run with local administrative group membership or have physical access to systems.

An attacker with valid credentials to a corporate domain (achieved via phishing, credential stuffing, or insider threat) logs into a Windows 10 workstation as a standard user without administrative rights. Leveraging the MMC access control flaw, the attacker executes specially crafted API calls or file operations targeting the vulnerable MMC process, bypassing authorization checks to escalate privileges to NT AUTHORITY\SYSTEM. With SYSTEM-level access, the attacker disables endpoint detection tools, extracts credentials from LSASS memory using Mimikatz, installs persistent backdoors, and pivots laterally to domain controllers or sensitive file servers. The low attack complexity means exploitation requires minimal technical skill once initial access is obtained.