Microsoft Trace Data Helper CVE-2026-70260

Exploitation requires the attacker to already have local, authenticated access to the Windows host at a low privilege level (PR:L) and the ability to interact with the Microsoft Trace Data Helper component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The key limiting factors are: (1) the vulnerability is local only (AV:L) - it cannot be triggered remotely over a network, so an attacker must first obtain code execution or an interactive session on the machine; and (2) it requires an existing low-privileged account rather than being reachable by a fully unauthenticated actor. Impact is confined to confidentiality (C:H, I:N, A:N): it discloses sensitive system information but does not by itself modify data or disrupt availability. The description does not state any non-default configuration prerequisite, so default installations of the affected Windows editions appear exposed to a local low-privileged attacker.

This is a genuine but moderate-priority issue, not a high-urgency emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5 MEDIUM) describes a local, low-complexity attack requiring the attacker to already hold low-level (authenticated) privileges on the host, yielding high confidentiality impact but no integrity or availability impact. All corroborating signals point in the same low-urgency direction: CISA's SSVC decision framework reports Exploitation=none (no observed or expected exploitation), Automatable=no, and Technical Impact=partial, which maps to a 'Track' rather than 'Act' posture. There is no CISA KEV listing and no POC referenced in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided, so exploitation probability cannot be quantified from this input. The signals are internally consistent - a local info-disclosure flaw that leaks sensitive system data to a low-privileged attacker - so there is no contradiction to flag. The main caveat is that absence of EPSS/KEV/POC is not proof of safety; it reflects data not provided rather than a guarantee, but on balance this is a confidentiality-only local privilege-adjacent leak suitable for routine patch-cycle remediation rather than out-of-band response.

A low-privileged local user (or malware already running under a standard user account) on a Windows host invokes the Microsoft Trace Data Helper component and reads back sensitive system information that should be restricted to a higher privilege sphere, using that data (e.g., to aid further privilege escalation or reconnaissance). Because the CVSS vector is AV:L/AC:L, exploitation requires prior local access and some authenticated foothold but no user interaction and little technical complexity. No public exploit code is identified at time of analysis.