Windows Cryptographic Services CVE-2026-70055

Exploitation requires an attacker to already have local, authenticated low-privileged access to the affected Windows host (per PR:L and AV:L) - it cannot be performed remotely or by an unauthenticated user. No user interaction is needed. The limiting factors are therefore the need for a valid local foothold and existing privileges, which confine realistic risk largely to shared, multi-user, or terminal-server systems and to post-initial-compromise escalation scenarios; single-user endpoints where the only account is already the attacker's target offer little additional gain. The specific Cryptographic Services feature or interface that leaks data is not named in the description, so no particular non-default configuration is identified as a prerequisite.

This is a moderate-severity local information disclosure flaw (CVSS 5.5) in Windows Cryptographic Services, categorized as CWE-497 (exposure of sensitive system information). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) tells a consistent story: exploitation requires local access and existing low-level privileges (an authenticated local user), needs no user interaction, and yields high confidentiality impact with no integrity or availability impact. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no public exploit identified at time of analysis. The combination of local-only attack vector plus required privileges materially lowers real-world urgency compared to a network-exploitable flaw - this is not a high-priority internet-facing threat but rather a local privilege-boundary/information-leak issue most relevant to multi-user hosts and post-compromise escalation chains. The description's 'authorized attacker' phrasing aligns with the PR:L metric, so the signals are internally consistent with no conflicts detected. Priority should be routine-to-moderate patching, elevated for shared/terminal-server environments where untrusted local users exist.

An attacker who already has low-privileged authenticated access to a Windows host (e.g., a standard user on a shared or terminal-server system) locally interacts with Windows Cryptographic Services to read sensitive system information they should not be able to access. No user interaction is required, and the disclosed data (such as cryptographic or system secrets) could then aid further privilege escalation or lateral movement. No public exploit code is identified in the provided data.