Windows StateRepository API CVE-2026-70218

Exploitation requires the attacker to already have local, authenticated, low-privileged code execution on an affected Windows 11 host (builds: 24H2 <10.0.26100.9711, 25H2 <10.0.26200.9711, 26H1 <10.0.28000.3231, 26H2 <10.0.26300.9711) and to invoke the Windows StateRepository API, whose access controls lack sufficient granularity. Limiting factors that reduce real-world risk: it is NOT remotely exploitable (AV:L), it cannot be triggered against default configurations from the network, it requires existing authenticated access (PR:L), and SSVC rates it non-automatable - so it functions only as a post-access escalation step, not an initial-access vector. No special non-default feature toggle is named in the description; the flaw appears inherent to the StateRepository API's authorization model.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local privilege-escalation flaw: the attacker must already have authenticated, low-privileged code execution on the host, but once there, exploitation is low-complexity, needs no user interaction, and yields total impact (C:H/I:H/A:H) - consistent with escalation to SYSTEM. These signals align well and reinforce each other: CISA's SSVC decision framework rates Technical Impact as 'total,' matching the C/I/A:H impact. The mitigating signals are strong, however: SSVC marks Exploitation as 'none' (no observed exploitation) and Automatable as 'no' (it cannot be reliably mass-exploited, fitting a local-only EoP that must be chained after initial access). There is no CISA KEV listing and no public POC identified, and no EPSS probability was provided in the input, so widespread opportunistic exploitation is currently unlikely. The realistic role of this bug is as a post-compromise escalation link in an attack chain (e.g., after phishing or a browser exploit), not an internet-facing entry point. Note one metadata inconsistency to verify: the input tag labels this an 'Authentication Bypass,' but the CWE-285 (Improper Authorization) mapping and the description ('insufficient granularity of access control... elevate privileges locally') describe a local authorization/privilege-escalation defect, not a network authentication bypass - treat the tag with caution.

An attacker who already has a foothold as a standard (low-privileged) user on a Windows 11 host - for example via a phishing payload or a browser/application compromise - invokes the Windows StateRepository API and abuses its insufficiently granular access control to perform actions reserved for higher-privileged accounts, escalating to SYSTEM. No user interaction is required and attack complexity is low, but local authenticated access is a prerequisite. No public exploit identified at time of analysis.