Microsoft Winlogon CVE-2026-42989

Attacker must already have an authenticated low-privileged interactive or remote session on the target Windows host (CVSS PR:L, AV:L) with the ability to create filesystem reparse points (symbolic links, NTFS junctions, or object-manager symlinks) in a location consumed by Winlogon - standard user accounts can create junctions and object-manager symlinks without SeCreateSymbolicLinkPrivilege, so this prerequisite is realistically met by any local user. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the bug is not remotely reachable over the network and cannot be triggered without prior local code execution, which meaningfully limits exposure to post-compromise scenarios rather than initial access.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is a local, low-complexity attack requiring a low-privileged authenticated session with no user interaction, yielding full CIA impact within the same scope - a classic local elevation-of-privilege profile that is highly attractive for post-compromise chaining (e.g., after phishing or browser exploitation). There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided in the input, so widespread opportunistic exploitation appears unlikely in the immediate term; however, link-following EoP bugs in Winlogon have historically been productized into reliable exploits quickly once details emerge. One inconsistency to note: the input includes a 'Information Disclosure' tag, which conflicts with the CVSS description of an elevation-of-privileges link-following bug - defenders should treat the CVSS vector and CWE-59 classification as authoritative and verify the impact category against the MSRC advisory.

An attacker who has already obtained low-privileged code execution on a Windows host - for example via a phishing payload, a malicious Office macro, or a compromised standard user account - plants a symbolic link or NTFS junction in a directory that Winlogon touches during session or profile handling, causing the SYSTEM-level Winlogon process to operate on an attacker-chosen target file. The result is a write, delete, or DACL change against a protected file that the attacker leverages to gain SYSTEM, completing a local privilege escalation. No public exploit has been identified at time of analysis, but link-following EoP primitives in Windows are well understood and historically weaponized rapidly.