Windows Server 2019 CVE-2026-32074

Local user authentication required on target Windows system with Windows Projected File System (ProjFS) enabled and actively handling file system operations through the vulnerable code path.

This vulnerability presents significant risk for environments where attackers have already established authenticated access. The CVSS 3.1 base score of 7.8 (High) reflects local attack vector requiring low privileges (PR:L) with low complexity (AC:L) and no user interaction, yielding complete compromise of confidentiality, integrity, and availability. However, real-world exploitation likelihood is moderated by the prerequisite of initial system access-attackers must already be authenticated to Windows with standard user credentials. SSVC decision factors indicate high technical impact (privilege escalation to SYSTEM) but exploitation requires targeted development against ProjFS kernel components. The absence of CISA KEV listing and public proof-of-concept code at analysis time suggests limited active targeting, though the widespread deployment of affected Windows versions (encompassing enterprise Server 2019/2022/2025, desktop Windows 10/11 across all current servicing channels) creates substantial attack surface. Priority should be elevated in environments with multi-user systems, jump servers, or scenarios where initial access is commonly achieved through phishing or credential compromise. The availability of vendor patches across all affected builds significantly reduces sustained risk for organizations with mature patch management.

An attacker who has gained initial access to a Windows environment through ph