Microsoft Account CVE-2026-68850

Exploitation requires a valid local user account on the affected Windows 11 or Windows Server 2025 system (PR:L, AV:L) - no administrative rights are needed, but the attacker must be able to execute code locally. The Microsoft Account component is present in default installations of all listed Windows 11 and Server 2025 builds. No interaction from any other user is required (UI:N). Key limiting factors: the attack vector is strictly local (AV:L), meaning purely network-based remote exploitation without an existing foothold on the target machine is not possible. Scope remains unchanged (S:U), so this step alone does not pivot to other systems. The vulnerability does not require any non-default feature enablement - the Microsoft Account subsystem is active by default on all affected platforms.

The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N accurately reflects a local privilege escalation that requires no special complexity or user interaction once a foothold exists. Any standard user account on an unpatched Windows 11 or Windows Server 2025 system is sufficient to trigger the overflow, making this directly relevant in multi-user environments, VDI deployments, RDP-accessible servers, and post-exploitation lateral-movement scenarios. No EPSS score is available in the provided intelligence, and the vulnerability does not appear in CISA KEV, with no public exploit code identified. Despite the absence of public exploit activity, the low attack complexity (AC:L) and absence of required user interaction mean exploitation would be straightforward to develop from the CWE-122 class alone; even a mid-sized enterprise IT team managing a broad Windows 11/Server 2025 estate - comparable in profile to an organization like a city of gliwice scale - should treat patching as urgent rather than deferred. The primary limiting factor is the local-only attack vector: remote-only attackers cannot exploit this without a pre-existing foothold.

A low-privilege user account on an unpatched Windows 11 or Windows Server 2025 system - for example, a restricted RDP session user or a shared workstation account - crafts a specific interaction with the Microsoft Account component that triggers the heap-based buffer overflow. By controlling the overflow payload to overwrite adjacent heap structures such as function pointers or object vtable entries, the attacker redirects execution to attacker-controlled code and escalates to SYSTEM privileges. No public exploit code has been identified, but the AC:L CVSS rating indicates the trigger condition is not complex, making independent development feasible.