Windows EFS CVE-2026-69794

Exploitation requires a valid local user account on the affected Windows system (PR:L); unauthenticated remote exploitation is not possible given AV:L. No user interaction, special configuration, or elevated privileges beyond a standard domain or local user account are required. The Encrypting File System feature must be present and accessible, which it is by default on all NTFS volumes in affected Windows versions. Exploitation is constrained to the local system (S:U), ruling out remote network exploitation. The primary limiting factors are the requirement for local authenticated access - this is not remotely exploitable directly - and the read-only nature of the flaw (I:N, A:N), which means it cannot be used standalone for persistence or system modification.

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the threat model: exploitation requires a valid local user account, but once authenticated no special configuration or user interaction is needed. The C:H metric is significant because EFS memory can contain file encryption keys or sensitive plaintext. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at this time. EPSS data was not provided in the intelligence set, so probabilistic exploitation risk cannot be quantified independently. Even a mid-sized municipal IT team in gdynia with mixed Windows Server estates should treat this as a standard Patch Tuesday priority - not an emergency, but not ignorable given that insider threats and post-compromise lateral movement both benefit from local information disclosure on encryption subsystems. The absence of a scope change (S:U) limits blast radius to the compromised local system, but if EFS keys are among the disclosed data, downstream confidentiality loss extends beyond the immediate host.

A low-privileged user with an authenticated local session on a Windows file server issues crafted API calls or file operations targeting the EFS subsystem, triggering a buffer over-read in the relevant EFS component. The read-beyond-bounds operation returns adjacent memory contents to the calling process, potentially including key material or other sensitive data cached in EFS-managed buffers. No public proof-of-concept has been identified, but the straightforward nature of AV:L/AC:L/PR:L exploitation means a motivated internal threat actor or post-initial-access attacker could leverage this without complex tooling.