Windows Storage Spaces CVE-2026-69575

Exploitation requires a valid local user account on the target Windows system - the CVSS vector specifies PR:L (low privilege), meaning any standard domain or local user account is sufficient; no administrator rights are needed. The Storage Spaces Controller component must be present and active, which is the default on all listed Windows versions including client and server SKUs. Attack complexity is high (AC:H), meaning exploitation likely requires race-condition timing or heap-grooming precision, reducing the likelihood of reliable one-shot exploitation without tailored tooling. Exploitation is strictly local (AV:L) - the flaw cannot be triggered over a network without prior local session access. Remote Desktop Protocol (RDP) or physical console access with a low-privilege account satisfies the prerequisites.

The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local, authenticated nature of this flaw - it cannot be exploited remotely. The AC:H metric is significant: UAF exploitation in kernel drivers typically requires a race condition or precise heap-grooming, making reliable exploitation non-trivial. EPSS data is not provided, and neither CISA KEV status nor public POC existence is indicated, suggesting this is a standard Patch Tuesday disclosure without confirmed in-the-wild exploitation. Despite the 7.0 score, this vulnerability warrants prompt patching priority in enterprise environments because: (1) Storage Spaces is enabled by default on many Windows Server deployments used as file/storage servers, (2) the affected version range covers essentially all supported Windows releases, and (3) local privilege escalation is the canonical second-stage payload after initial access in ransomware and APT intrusions. No conflicting signals between CVSS and description - both confirm local-only, low-privilege exploitation.

An attacker who has already obtained a low-privilege foothold on a Windows system - via phishing, credential theft, or exploitation of a web-facing service - logs on locally or via RDP and triggers the Storage Spaces Controller UAF through a crafted sequence of storage pool operations, winning a race condition to corrupt freed kernel memory. The attacker uses this kernel-mode write primitive to overwrite a process token, elevating the malicious process to SYSTEM, enabling credential dumping, lateral movement, or ransomware deployment. No public POC is confirmed, making this scenario contingent on independent exploit development.