Windows Filtering Platform CVE-2026-50405

Exploitation requires the attacker to already possess a local, authenticated low-privileged account on the target (CVSS PR:L, AV:L), from which code is run against the Windows Filtering Platform interface; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attack cannot be launched remotely and cannot be the initial access vector - the attacker must first land a foothold on the host - and the flaw is confined to Windows systems running the affected WFP code (Windows 10/11 and Windows Server 2012-2025). The available data does not indicate any non-default configuration or specific feature toggle is required, so default installations appear exposed once local access is obtained.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8, High) describes a low-complexity local attack requiring an existing low-privileged foothold and no user interaction, yielding full compromise of confidentiality, integrity, and availability - the classic elevation-of-privilege profile. No EPSS score, SSVC decision, KEV entry, or POC was provided, so exploitation probability cannot be quantified from the input; treat the absence of an EPSS/POC signal as unknown, not as low risk. This is a realistic second-stage priority: it is not remotely exploitable and cannot be the initial entry point, but as a reliable local SYSTEM escalation across nearly all Windows versions it is highly valuable in post-compromise chains and should be patched on the normal-to-expedited cycle. One data conflict to flag: the primary NVD description characterizes this as privilege elevation, yet the vendor Tags label it 'Information Disclosure' - verify the exact impact class against the MSRC advisory before finalizing internal categorization.

An attacker who has already gained a standard low-privileged user session - via phishing, a compromised service account, or an earlier remote bug - runs a crafted local process that abuses WFP's overly permissive access control to escalate to SYSTEM. Given the low attack complexity and no user-interaction requirement, this makes a reliable post-exploitation step, though no public exploit code has been identified in the provided data.