Windows Key Guard CVE-2026-50378

The attacker must already have authenticated local access with at least low privileges (CVSS PR:L, AV:L) - this is not remotely exploitable and requires an existing foothold on the target. No user interaction is needed (UI:N). The principal limiting factor is the race condition itself (AC:H): exploitation depends on winning a narrow timing window in Windows Key Guard's access to a shared resource, which is non-deterministic and cannot be reliably automated (SSVC Automatable: no), so success typically requires repeated attempts and favorable timing/scheduling conditions. Realistic risk is concentrated on multi-user systems (RDS/terminal servers, shared workstations, jump boxes) where untrusted low-privileged users can run code; single-user, well-isolated endpoints are far less exposed.

The signals are internally consistent and point to a genuine-but-not-urgent local escalation issue. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0) shows local access with LOW privileges already required, and critically AC:H - a high-complexity race that an attacker must win a timing window to trigger - which tempers the otherwise-total C/I/A impact. This aligns with SSVC (Exploitation: none, Automatable: no, Technical Impact: total): the 'total' impact matches the full C/I/A compromise, while 'Automatable: no' matches AC:H because a timing race cannot be reliably scripted at scale. EPSS of 0.24% (16th percentile) reinforces low near-term exploitation likelihood, and there is no KEV listing and no public PoC. This is a patch-in-normal-cycle item, not a drop-everything emergency; it becomes higher priority on multi-user or shared/terminal-server hosts where untrusted local users have footholds. No signals conflict - the low EPSS, no-exploitation SSVC, and AC:H all agree that real-world risk is currently modest despite the high technical impact.

An attacker who already has a low-privileged foothold on a Windows host - for example a standard user account, or code running after a phishing-based initial access - repeatedly triggers the Key Guard operation to hit the narrow synchronization window. On a successful race win, they corrupt the shared resource's state to execute with elevated privileges, gaining full control of the machine. No public exploit code is identified at this time, and the AC:H rating means the attacker likely needs many attempts, but the payoff is total system compromise.