Windows WebDAV CVE-2026-70262

Exploitation requires the victim's Windows WebDAV client (the WebClient service / WebDAV redirector) to process attacker-controlled data, which per CVSS UI:R means a user must be induced to connect to or open an attacker-controlled WebDAV resource (malicious server, WebDAV UNC path, or document-embedded reference). Limiting factors: the mandatory user interaction prevents unattended or wormable exploitation (reflected in SSVC Automatable=no); the targeted host must have the WebDAV/WebClient functionality active and be able to reach the attacker's resource; and only builds below the fixed versions listed in the EUVD data (e.g. Windows 11 24H2 <10.0.26100.9711, Server 2022 <10.0.20348.5761) are vulnerable. There is no authentication requirement on the attacker side (PR:N), but the social-engineering step is the practical gate.

This is a genuine high-priority patch candidate but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw with total confidentiality, integrity and availability impact - however the UI:R flag means a victim must perform an action (e.g. connect to or open an attacker-controlled WebDAV resource), which is the single largest mitigating factor. CISA's SSVC decision framework contradicts the raw severity in a useful way: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably mass-exploited, consistent with the UI:R requirement), while Technical Impact=total (aligns with C:H/I:H/A:H). KEV status is NO and no POC is indicated, so there is no public exploit identified at time of analysis. Note a semantic tension that defenders should verify: the description calls this a privilege-elevation ('elevate privileges') by an 'unauthorized attacker over a network,' yet the CVSS vector models it as a network + user-interaction heap overflow in the WebDAV component - this is the classic Windows WebDAV client (WebClient) pattern where a lured connection to a malicious share yields code execution in the victim's context rather than a pure local EoP. Net assessment: patch promptly given ubiquitous Windows footprint and total impact, but the UI:R requirement and SSVC Automatable=no place it below wormable/zero-interaction network bugs in urgency.

An attacker stands up a malicious WebDAV server (or a crafted WebDAV resource) and lures a victim into connecting to it - for example via a phishing link, a UNC/WebDAV path, or an Office document reference. When the victim's WebDAV client processes the attacker's response, a heap-based buffer overflow (CWE-122) is triggered, allowing code execution in the victim's context. No public exploit code is identified at time of analysis, and user interaction is required, so this is not a drive-by attack.