Windows Shell CVE-2026-27918

Exploitation requires the attacker to already have local, authenticated access to the Windows host with at least low-level user privileges (PR:L) - this is not remotely reachable (AV:L). The attacker must trigger a race condition (CWE-362) in the Windows Shell's handling of a shared resource and win a timing window; high attack complexity (AC:H) means success is probabilistic and typically requires repeated attempts, which limits reliability. No user interaction is needed (UI:N). The primary limiting factors are the mandatory pre-existing local foothold with valid credentials and the non-deterministic race window, which substantially reduce real-world exploitability despite the total technical impact. Hosts patched to the fixed builds (e.g., Server 2025 >=10.0.26100.32690, Win11 24H2 >=10.0.26100.32690, Win10 22H2 >=10.0.19045.7184) are not affected.

This is a legitimate but non-urgent local privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) signals that an attacker must already have local access and low-level (authenticated) privileges, and must win a race window (AC:H) to succeed - meaning exploitation is non-deterministic and not trivially reliable. All real-world exploitation signals point low: EPSS is 0.04% (12th percentile), CISA SSVC records Exploitation:none and Automatable:no, and there is no KEV listing and no public POC. These signals are mutually consistent - low EPSS, no automatability, and no observed exploitation together indicate this is NOT an active or wormable threat. The one signal pulling upward is SSVC Technical Impact:total, which aligns with the C:H/I:H/A:H full-SYSTEM-level compromise that a successful Windows Shell race win would grant. Net assessment: a real but second-tier patch priority - it requires an attacker who already has a foothold with valid credentials, and the high attack complexity plus absence of exploitation evidence place it well below internet-facing or unauthenticated-RCE flaws. Note a metadata conflict: the Tags include 'Information Disclosure' while the Description and CVSS (I:H/A:H) clearly describe privilege elevation, not mere disclosure - treat the EoP framing as authoritative.

An attacker who has already gained a low-privileged authenticated foothold on a Windows host (e.g., via phishing or a standard user account) runs a local tool that repeatedly triggers the vulnerable Windows Shell operation, racing the improper synchronization window to corrupt shared state and gain SYSTEM-level privileges. Because attack complexity is high (AC:H) the exploit must be run many times to win the race, and no public exploit code is currently available, making opportunistic use unlikely.