Windows Smart Card CVE-2026-69785

Exploitation requires an authenticated local session on the affected Windows system with at least low-privilege user rights (PR:L per CVSS). The attacker must have write access to a directory that precedes the legitimate system directory in the search path queried by the Smart Card subsystem - for example, the current working directory, a user-writable PATH entry, or a directory with weak ACLs. The Windows Smart Card feature must be present (it is enabled by default on Windows). No special hardware smart card reader is required to trigger the vulnerable code path. Exploitation is constrained to local access only (AV:L); remote unauthenticated exploitation is not possible. Environments that restrict local logon to administrators, enforce strong directory ACLs, or use AppLocker/WDAC to block unsigned DLL loading are meaningfully harder to exploit.

CVSS 7.8 (High) is consistent with the attack profile: local access with low privileges, no complexity, full system impact upon successful exploitation. The S:U (no scope change) indicates the attacker's elevated access remains within the compromised host rather than pivoting directly to adjacent systems, though post-escalation lateral movement is feasible. No EPSS score was provided in the input; without it, exploitation probability cannot be quantitatively benchmarked. The vulnerability is not listed in CISA KEV, and no POC has been identified at time of analysis, suggesting opportunistic mass exploitation is not currently occurring. However, the attack class (DLL hijacking/untrusted search path) is well-understood and highly reliable once an attacker has local foothold - tooling for this class of vulnerability is mature and widely available in offensive frameworks. The breadth of affected versions (19 distinct Windows SKUs spanning over a decade of releases) is notable. Real-world risk is elevated for environments where untrusted users share Windows hosts, such as VDI, terminal server, or multi-tenant workstations, as this provides a reliable local-to-SYSTEM escalation path.

An attacker who has obtained a low-privilege local account on a Windows host - via phishing, credential stuffing, or lateral movement - places a malicious DLL or executable in a directory that appears in the search path consulted by the Windows Smart Card service or its associated components before the legitimate system path. When the Smart Card subsystem initializes or processes a smart card event, it loads the attacker's DLL, executing arbitrary code at an elevated privilege level. No public exploit code exists at time of analysis, but the DLL hijacking technique is well-established in penetration testing toolkits.