Windows Shell CVE-2026-69528

A low-privileged local user account on an affected Windows 11 or Windows Server 2025 build is the only prerequisite - consistent with CVSS PR:L. No non-default configuration, specific feature flag, or service enablement is required; any standard Windows Shell installation within the vulnerable build ranges is affected in its default state. Exploitation is bounded by the local attack vector (AV:L): remote unauthenticated attackers cannot directly trigger this flaw and must first establish a local session via RDP with valid credentials, a compromised service account, physical access, or a chained remote vulnerability. The absence of user interaction (UI:N) means the target user need not click, open a file, or be present at the console once the attacker has a session.

The CVSS 7.8 High rating accurately reflects a local, low-complexity privilege escalation with no user interaction - a class consistently prioritized in enterprise patch cycles. The local attack vector (AV:L) limits opportunistic remote exploitation: an attacker must already have a foothold or a legitimate low-privileged account before leveraging this flaw. EPSS data is absent from the provided intelligence, so exploitation probability cannot be compared to the CVSS signal; that gap should be filled from NVD or FIRST EPSS feeds before final triage. No CISA KEV listing and no public POC are confirmed, indicating no known active widespread exploitation. However, the total SSVC technical impact (C:H/I:H/A:H - full SYSTEM-level control) combined with the ubiquitous deployment footprint of Windows 11 and Server 2025 makes this a meaningful lateral-movement enabler for any attacker who has already gained a low-privilege session through phishing or another vulnerability. The low complexity (AC:L) means weaponization would be straightforward once the specific unprotected function is identified, even absent a published POC.

An attacker with any standard low-privileged local Windows account - obtained through phishing, credential stuffing, lateral movement from another host, or an insider threat - directly invokes the unauthenticated Shell function, bypassing the expected privilege check and escalating to SYSTEM or Administrator without triggering any user interaction. From that elevated position, the attacker can dump cached credentials from LSASS, disable endpoint detection tools, or install persistent backdoors. No public POC is confirmed, but the AC:L rating indicates exploitation would be mechanically straightforward once the unguarded function is identified.