Windows VOLSNAP.SYS CVE-2026-69427

The attacker must hold a low-privileged authenticated account on the target Windows system or network (PR:L per CVSS vector). The exploit path is network-reachable (AV:N), consistent with a remotely invoked Volume Shadow Copy or RPC-based interaction with VOLSNAP.SYS. User interaction is required (UI:R), likely corresponding to a user or privileged service triggering a volume shadow copy operation at the moment of exploitation - meaning the attacker cannot independently force the exploit to complete without some concurrent activity on the target. Unauthenticated remote exploitation is not indicated by the available data. The vulnerability is not restricted to a specific non-default configuration - VSS is enabled by default on Windows - but successful exploitation over the network requires the VSS/RPC service to be reachable from the attacker's network position. The UI:R requirement, while a real constraint, should not be relied upon as a compensating control since scheduled backup jobs and administrative shadow copy operations occur frequently in enterprise environments.

The CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) represents a meaningful real-world risk: network reachability with low complexity and only a low-privileged account is a strong exploitation profile, partially offset by the UI:R requirement. The affected surface is exceptionally broad - Windows is ubiquitous and the vulnerability spans Server 2012 (formally end-of-life but covered here), Server 2012 R2, Server 2016, 2019, 2022, 2025, and Windows 10/11 across multiple feature updates - making mass exposure a realistic concern once exploitation tooling matures. No EPSS score was provided in the input, so statistical exploitation probability cannot be independently assessed. No CISA KEV listing and no public proof-of-concept code have been identified, suggesting exploitation remains theoretical or non-public at time of analysis. The UI:R constraint provides a partial mitigating factor but should not be treated as a reliable compensating control in production environments. Overall, the combination of network vector, low-privilege requirement, ubiquitous deployment, and full C:H/I:H/A:H impact places this firmly in patch-urgently territory, especially for internet-facing Windows Server deployments exposing VSS-accessible network services.

A low-privileged domain user or service account authenticates to a Windows host exposing Volume Shadow Copy functionality over the network, then submits a crafted VSS request that triggers an out-of-bounds read in VOLSNAP.SYS. The OOB read leaks kernel memory content - potentially including pointers that defeat KASLR - which the attacker uses in a subsequent operation to escalate to SYSTEM-level execution. No public exploit code exists at time of analysis, but the low access complexity and network vector make this an attractive target for post-exploitation frameworks once a working primitive is developed.