Windows RPC CVE-2026-42976

The attacker must hold at least a low-privileged local authenticated session on the target system - CVSS PR:L and the description's phrase 'authorized attacker' confirm a valid OS account is required; unauthenticated remote exploitation is not possible (AV:L, S:U). No user interaction is needed beyond the attacker's own actions (UI:N), and no race condition or environmental timing is required (AC:L). The Windows RPC service is active by default on all listed platforms, meaning no non-standard feature enablement is necessary. Exploitation is constrained to the local machine boundary - the attacker cannot pivot to other systems directly through this flaw alone (S:U). The primary limiting factor is the requirement for any valid local account, which in practice means this flaw is a post-initial-access escalation tool rather than an entry point. Windows Server 2012 and 2012 R2 patching is further gated on Extended Security Update enrollment.

The CVSS 7.8 High score is internally consistent - local vector, low complexity, low privileges, and full C/I/A impact accurately reflect a post-foothold privilege escalation path to SYSTEM. SSVC corroborates this profile: technical impact is total, but exploitation status is none and the attack is not automatable, meaning it is not a mass-exploitation vector and does not currently appear in CISA KEV. EPSS data was not provided, so probability-of-exploitation quantification cannot be confirmed from available sources. The absence of a public POC and no KEV listing moderates immediate urgency somewhat, yet the breadth of affected Windows versions - from end-of-extended-support Server 2012 through the current Server 2025 - means the overall exposure surface is extremely large; even a mid-sized municipal IT team in kielce should treat this as urgent remediation for any environment where threat actors may have achieved even a minimal initial foothold, since local privilege escalation is the standard post-compromise stepping stone toward lateral movement and domain-wide impact. The non-automatable SSVC rating is consistent with AV:L, confirming this cannot be weaponized at scale without prior local access.

An attacker who has compromised a low-privileged domain user account - via phishing, credential stuffing, or lateral movement - logs on locally or via Remote Desktop to an unpatched Windows host. The attacker invokes a crafted RPC call targeting the unauthenticated critical function, bypassing the absent authorization check and obtaining SYSTEM privileges on the machine. No public proof-of-concept exists at time of analysis, but the low attack complexity (AC:L) means that once the patch differential is reverse-engineered from the released update, weaponization is straightforward.