Power Dependency Coordinator CVE-2026-69321

Exploitation requires an existing authenticated local user account with standard (low) privileges - the CVSS PR:L metric confirms this. The attacker must have a local session on the target system, achieved via interactive logon, RDP, or an already-established low-privilege shell. No special Windows configuration, non-default feature enablement, or specific hardware is described as a prerequisite; the unauthenticated function appears accessible to any low-privileged local account in default Windows configurations across all listed versions. Exploitation is strictly bounded by the local attack vector (AV:L): remote-only attackers cannot reach this vulnerability without first obtaining local code execution on the target system. No user interaction is required once local access is established.

The CVSS 5.5 Medium rating accurately reflects the constrained attack surface: local access with low privileges is required, and impact is integrity-only (I:H, C:N, A:N). There is no confidentiality or availability impact, ruling out direct data exfiltration or denial of service as primary outcomes. EPSS data is absent from the input; no exploitation probability baseline can be stated. The vulnerability is not listed in CISA KEV, and no proof-of-concept code is referenced. The SSVC technical impact is partial - limited to integrity on the local system without scope change. Despite ubiquitous Windows deployment, the practical threat is bounded: an attacker must already hold a local session, limiting the vector to insider threat, post-exploitation pivoting, or physical access scenarios. The integrity impact on power dependency mappings could theoretically be chained into a persistence or privilege escalation primitive, but that chain is not described in available data. This is a real but non-urgent patching priority for most environments, elevated to higher urgency in multi-tenant or shared-workstation deployments where low-privileged local users are untrusted.

An attacker who has compromised a low-privileged user account on a Windows workstation or server directly calls an unauthenticated function in the Power Dependency Coordinator, bypassing the authentication check that should gate the operation. By manipulating power dependency entries, the attacker can alter how the system handles device power transitions, potentially disrupting service startup ordering or using the tampered state as a persistence foothold in a broader attack chain. No public proof-of-concept code has been identified at time of analysis.