Remote Registry Service CVE-2026-59138

Exploitation requires the attacker to hold valid, low-privilege credentials on the target system or domain, as indicated by PR:L in the CVSS vector; unauthenticated exploitation is not supported by the available data. The Remote Registry Service (RemoteRegistry) must be running and network-reachable on the target host - the service is present in Windows but is disabled by default in some deployment profiles, so environments that have explicitly enabled it for remote management, monitoring, or Group Policy-dependent tooling face higher exposure. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning once authenticated network access exists, triggering the crash requires no additional setup or race conditions. Exploitation is bounded to a denial-of-service outcome only; no code execution, privilege escalation, or data exfiltration path is described. The SSVC 'automatable: no' rating indicates the attack cannot be trivially scripted for mass exploitation without per-target valid credentials.

The CVSS 3.1 base score of 6.5 (Medium) accurately reflects the impact ceiling of a DoS-only vulnerability with no confidentiality or integrity components. The network attack vector with low complexity and low-privilege requirements lowers the bar for exploitation, but the SSVC assessment - exploitation status 'none', automatable 'no', technical impact 'partial' - indicates no observed exploitation activity and suggests the attack path is not trivially scriptable at scale, since per-target authentication is a prerequisite. No EPSS score was provided in the source data, so exploitation probability is inferred as low based on the SSVC status and absence of any KEV or POC listing. There is no conflict between the CVSS vector and the description: both consistently indicate a network-accessible, authenticated path to a service crash with no scope change. Even a mid-sized municipal IT team in olsztyn should treat this as a routine patch-cycle item rather than an urgent emergency response, given the bounded blast radius, the authentication requirement that limits opportunistic mass exploitation, and the complete absence of confirmed active exploitation.

An attacker with low-privilege domain credentials or equivalent network authentication sends a specially crafted MS-RRP protocol request to the Remote Registry Service on a reachable Windows host, triggering a null pointer dereference that crashes the RemoteRegistry service process. If the service is not configured to auto-restart, remote registry functionality is lost until manually restarted or the system reboots, disrupting dependent administrative and monitoring operations. No public proof-of-concept exploit is identified at time of analysis.