Windows WalletService CVE-2026-49176

Exploitation requires the attacker to already have a local, authenticated foothold with at least low privileges on the target (PR:L, AV:L) and the ability to run code that interacts with the Windows WalletService component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker cannot trigger this remotely or unauthenticated - a prior standard-user session is mandatory - and the affected surface is the WalletService present in the listed Windows 10/11 and Windows Server (incl. Server Core) builds, so hosts already patched with the corresponding Microsoft cumulative update are not exploitable.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H = 7.8 High) describes a classic elevation-of-privilege primitive: local access and low existing privileges are required, no user interaction, low attack complexity, and full compromise of confidentiality, integrity and availability within the same scope. No EPSS score, POC, or KEV entry was provided, so there is no evidence of active exploitation or a public exploit at this time - the practical risk is that of a reliable post-compromise privilege escalation, valuable to attackers who already have a foothold (e.g., malware, a phished standard user, or a low-privilege service). Because exploitation is local and requires an authenticated account, this is not a remote-perimeter emergency, but the H/H/H impact combined with the enormous Windows install base makes it a meaningful patch-priority item for endpoint and server fleets. If EPSS or KEV data later indicates real-world use, priority should be raised accordingly.

An attacker who already holds a standard (low-privileged) authenticated session on a Windows host - for example via commodity malware or a compromised user - runs a crafted local program that abuses WalletService's improper privilege management to obtain SYSTEM-level execution. Because the CVSS vector is AV:L/AC:L/PR:L/UI:N, no victim interaction is needed and the technique is low-complexity, though it presupposes the attacker's initial local foothold. No public POC was identified at time of analysis.