EUVD-2026-73043
GHSA-qfw3-375v-hwhx
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local IPC access requires authenticated session (PR:L), non-trivial exploit conditions (AC:H); full C/I/A reflects SYSTEM-level privilege escalation on the vulnerable host.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Deserialization of untrusted data in Windows IP Address Management (IPAM) Service allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation in Windows IP Address Management (IPAM) allows an authenticated local user on any of a broad range of unpatched Windows 10, 11, and Windows Server releases to obtain full system-level control by supplying a crafted serialized payload to the IPAM service. The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data) and carries a CVSS 3.1 base score of 7.0 under a local, high-complexity attack vector with full C:H/I:H/A:H impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must already hold a valid local user account on the target system (PR:L per CVSS - a low-privileged authenticated session is the minimum entry point; unauthenticated remote exploitation is not possible). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.0 correctly moderates what would otherwise appear to be a critical severity based on C:H/I:H/A:H: the local attack vector (AV:L) and high attack complexity (AC:H) substantially narrow the realistic threat population to attackers who already hold a local session and can navigate non-trivial exploit conditions such as precise timing, specific service state, or a particular serialization path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released cumulative updates through Windows Update or the Microsoft Update Catalog to reach the fixed build thresholds: Windows Server 2025 and Windows 11 24H2 to 10.0.26100.33438 (server) or 10.0.26100.9445 (client); Windows Server 2022 to 10.0.20348.5622; Windows Server 2019 and Windows 10 1809 to 10.0.17763.9245; Windows Server 2016 and Windows 10 1607 to 10.0.14393.9512; Windows 11 23H2 to 10.0.22631.7582; Windows 11 25H2 to 10.0.26200.9445; Windows 11 26H1 to 10.0.28000.2954; Windows 10 21H2/22H2 to 10.0.19044.7725/10.0.19045.7725. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Windows 10, 11, and Windows Server systems running IPAM services and document their current patch levels. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today