Windows Secure Kernel CVE-2026-70017

Exploitation requires the attacker to already have local, authenticated low-privilege code execution on the affected Windows system (PR:L, AV:L) and to invoke the specific Secure Kernel Mode (Virtualization-Based Security / VSM) code path affected by the type confusion; there is no remote or network-facing vector and no user interaction is needed. Limiting factors that reduce real-world risk: the attacker must first obtain a foothold with valid local privileges, the impact is confined to information disclosure (no integrity or availability impact), and only Windows builds below the patched versions listed in EUVD-2026-99134 (e.g., Windows 11 24H2 <10.0.26100.9711, Server 2025 <10.0.26100.33650, Server 2019 <10.0.17763.9376) are vulnerable.

This is a genuinely medium-severity, low-priority issue rather than an emergency. The provided CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 5.5) describes a locally-exploitable information-disclosure flaw that requires the attacker to already possess low-level (authenticated) privileges on the target host; there is no network attack surface and no integrity or availability impact. All real-world exploitation signals align and reinforce this low-urgency picture: the CISA SSVC decision framework reports Exploitation=none (no observed or expected exploitation), Automatable=no, and Technical Impact=partial, and there is no CISA KEV listing and no public proof-of-concept - i.e., no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The only elevating factors are the high confidentiality impact (C:H, kernel memory disclosure) and the ubiquity of Windows; however, the local vector and prior-privilege requirement make this a credential/foothold-dependent secondary capability (e.g., for defeating KASLR or reading secrets after initial compromise) rather than a standalone priority. Patch during the normal cycle.

An attacker who has already gained the ability to run code on a Windows host as a low-privileged authenticated user triggers the type-confusion flaw in Secure Kernel Mode to read memory that should be isolated from them. This is a local-only, AC:L operation requiring no user interaction, but it yields only information disclosure (C:H, no I/A), making it most useful as a post-foothold step to leak kernel addresses or secrets. No public exploit code or active exploitation has been identified at time of analysis.