Windows Digest Authentication CVE-2026-62698

Exploitation requires an attacker to already possess a low-privilege local account with the ability to authenticate on the target Windows system - reflected in PR:L and AV:L in the CVSS vector. The vulnerable code path runs through the Microsoft Digest Authentication subsystem, which is a default Windows component present across all affected builds without requiring non-default configuration. No user interaction from a privileged account is needed (UI:N), and the attack does not escape its security scope (S:U). The primary limiting factor is the requirement for prior local access: remote unauthenticated exploitation is not supported by the AV:L vector, meaning attackers must already have a foothold on the target machine via a valid account or earlier compromise. No additional non-default feature enablement is specified in the available data.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) places this as a local, low-complexity, low-privilege attack with total impact - a classic local privilege escalation profile. No EPSS score was included in the source data, so probabilistic exploitation likelihood cannot be quantified here; security teams should retrieve current EPSS values from the NVD record. The vulnerability is absent from the CISA KEV catalog and no proof-of-concept has been identified, which moderates near-term exploitation urgency. Despite those mitigating signals, the sheer breadth of affected platforms - spanning decade-old Server 2012 installations through current Windows 11 and Server 2025 - means that virtually every Windows estate is within scope; even a mid-sized municipal IT team in tczew managing a heterogeneous Windows fleet should treat this as urgent patch-cycle work. A notable discrepancy exists between the vendor-supplied tag 'Information Disclosure' and the CVE description's claim of local privilege escalation - security teams should cross-check the MSRC advisory directly to confirm the definitive impact category before triaging.

A low-privileged domain or local user with interactive logon access submits a crafted authentication exchange through the Windows Digest Authentication subsystem, triggering an integer truncation that corrupts an internal size or bounds value used in subsequent memory operations. By controlling the shape of the malformed credential data, the attacker manipulates memory in the authentication process at sufficient privilege to escalate to SYSTEM level without any interaction from a higher-privileged user. No public exploit code has been identified at time of analysis, but the low attack complexity rating (AC:L) indicates that exploitation does not require unusual preconditions or timing.