Windows EFS CVE-2026-69841

The attacker must have a valid local user account (PR:L - standard Windows user-level access is sufficient; no administrative privileges required). The attack is local (AV:L), meaning the attacker must be able to execute code on the target system - remote-only network access is insufficient without a separate initial access vector. No user interaction is required from any other account. The EFS component does not need to be actively encrypting files for the vulnerable code path to be reachable, as it is present in all affected Windows installations by default. Limiting factors: no remote unauthenticated path exists; exploitation is constrained to sessions or processes already running under a local account on the target machine. Organizations that strictly limit who can interactively log on or execute processes locally significantly reduce exposure.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a reliable local privilege escalation: low complexity, standard user account sufficient, no interaction required, full CIA impact after escalation to SYSTEM. No EPSS score or KEV listing is present in the input, meaning exploitation probability and confirmed in-the-wild activity are unknown from available data. The breadth of affected versions - 19 distinct Windows product lines - increases aggregate exposure significantly. No public exploit or POC is identified, which tempers immediate priority, but LPE vulnerabilities with AC:L/PR:L in Windows historically attract rapid weaponization once disclosed. The Microsoft MSRC reporter designation (secure@microsoft.com) is consistent with internal discovery, reducing the likelihood of pre-patch exploitation. Real-world risk is meaningful: any environment with multi-user Windows systems or where lateral movement from a low-privileged foothold is a concern should treat this as a prioritized patch - particularly Windows Server environments where EFS may be active. Missing: no EPSS score, no KEV, no confirmed POC; exploitation probability is inferred from CVSS complexity metrics alone.

An attacker who has obtained a low-privileged local user account - via phishing, credential stuffing, or lateral movement - invokes a crafted EFS API call that triggers the heap-based buffer overflow in the EFS service, corrupting adjacent heap structures and redirecting execution to attacker-supplied shellcode running as SYSTEM. No public POC exists at time of analysis, but the low attack complexity (AC:L) suggests that once an exploit is developed it would be straightforward to execute reliably. In multi-user Windows Server environments, this class of LPE is particularly attractive for post-exploitation privilege escalation after initial compromise of a low-privileged service or user account.