Windows Shell CVE-2026-69383

Requires an authorized local user account with at least standard (low) privileges - the CVSS PR:L metric confirms authentication is required and PR:N (unauthenticated) does not apply. Network-based exploitation is not possible; the attacker must have an interactive or remote-desktop session on the targeted host (AV:L). AC:H indicates that exploitation is not trivially reproducible and likely demands precise timing (race condition) or specific environmental state such as a particular directory layout, symbolic link precondition, or Shell invocation context. No user interaction from a victim is required once the attacker's session is established (UI:N). Exploitation is limited to Windows 11 (23H2-26H1) and Windows Server 2025 on unpatched builds; earlier Windows versions are not listed as affected.

CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the threat profile: local-only attack surface, non-trivial exploitation conditions (AC:H implies a race condition, symlink race, or specific configuration prerequisite), and low-privilege starting point. Despite the full C/I/A:H triple impact, the local-only, high-complexity nature substantially limits real-world exposure - an attacker must first gain a foothold on the machine via another vector before this becomes relevant. No EPSS score was provided; KEV status is not confirmed; no public proof-of-concept exists at time of analysis. In practical terms this is a second-stage escalation primitive rather than an entry-point vulnerability. Priority is elevated for multi-user systems (servers, VDI environments, shared workstations) where low-privileged users have shell access, and for any endpoint where attacker persistence at user level is already a concern.

An attacker who has already obtained a low-privileged shell on a Windows 11 or Server 2025 system - for example through a phishing payload or credential stuffing - triggers the Windows Shell into resolving a file path the attacker controls, such as a symbolic link or junction pointing to a sensitive system file. The Shell performs the operation with elevated authority, writing or executing attacker-supplied content in a privileged context and yielding SYSTEM or administrator access. The AC:H requirement suggests the attacker must win a race condition or satisfy a specific precondition (such as a particular Shell state or directory layout) to reliably trigger the path substitution.