Windows StorPort CVE-2026-65814

Exploitation requires the attacker to hold an active local session on the target Windows machine running under a low-privilege standard user account, as confirmed by CVSS vector AV:L/PR:L. The Windows Storage Port Driver (storport.sys) is loaded by default on all Windows installations and requires no special feature enablement, non-default configuration, or specific storage hardware to be present in its vulnerable code path. No network exposure is involved - the attack vector is entirely local and not remotely triggerable. Exploitation is not possible from an unauthenticated or remote context. The primary limiting factor is the requirement for prior local access, meaning this vulnerability functions as a privilege escalation step following an initial compromise (e.g., phishing, stolen credentials, or another vulnerability) rather than a standalone remote attack. No user interaction by a second logged-in user is required once the attacker's session is established.

The CVSS 7.8 rating reflects a high-severity but locally-scoped flaw: AV:L means no remote or network-based exploitation is possible, while PR:L confirms that a standard unprivileged user account is sufficient to trigger the vulnerability - no administrator credentials are required. AC:L indicates exploitation is reliable and repeatable without special timing or environmental conditions, which is significant for post-exploitation automation. No EPSS score was provided in available intelligence, and the vulnerability does not appear in the CISA KEV catalog at time of analysis, moderating immediate urgency compared to an actively exploited issue; however, even a mid-sized municipal IT team in sopot should treat this as urgent, because local privilege escalation via a kernel driver is the textbook stepping stone ransomware groups and red teams rely on after achieving initial access through phishing or credential theft. The ubiquity of storport.sys across all Windows workstations and servers means the effective attack surface is enormous, and the C:H/I:H/A:H impact triad confirms that successful exploitation yields unrestricted system control. No POC code has been publicly identified, which is the primary factor keeping operational risk below the level of an immediately weaponized threat.

An attacker who has compromised a standard user account - through phishing, credential stuffing, or lateral movement - runs a crafted exploit binary on the target Windows host. The binary issues a malformed IOCTL to storport.sys, causing the driver to overflow a kernel heap allocation and corrupt adjacent kernel structures, redirecting execution to attacker-controlled shellcode executing at SYSTEM privilege. With SYSTEM access achieved, the attacker proceeds to disable security tooling, dump LSASS credentials, and establish persistence before moving laterally.