Windows Management Services CVE-2026-70348

The attacker must hold an active local session on the affected Windows 11 host - either interactive or via a remote desktop session - with at minimum a standard (low-privilege) user account, consistent with PR:L in the CVSS vector. Windows Management Services must be running, which is the default state on affected Windows 11 builds. Exploitation requires the ability to create directory junctions on the local filesystem; unlike symbolic links, junctions do not require the SeCreateSymbolicLinkPrivilege and are creatable by standard user accounts, making this a practical prerequisite on default configurations. Exploitation is limited to availability impact only (no data exfiltration or privilege escalation path is indicated), the attack is local-only (no network exposure), and no user interaction beyond the attacker's own session is required.

The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) places this vulnerability in the medium-severity band with a strictly local attack vector - remote exploitation is not possible. The low privilege requirement (PR:L) means a standard user account suffices, which is a relevant risk on shared workstations, VDI environments, or developer machines where multiple users have interactive sessions. No EPSS data was provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified independently. The absence of a CISA KEV listing and lack of any identified POC further support treating this as a lower-priority item in most environments; even a mid-sized municipal IT team in sanok should weigh this against higher-severity network-exploitable flaws before dedicating emergency patching resources. Notably, the source tag 'Information Disclosure' is inconsistent with the CVSS vector (C:N, I:N) and the description, which confirms a denial-of-service outcome only - this tag appears to be a mis-categorization and should not be used to infer data exposure risk.

A standard Windows user account on an affected Windows 11 host creates a directory junction at a filesystem path that Windows Management Services accesses during normal operation. When the service follows the junction without verifying the resolved target, it is redirected to an unintended location, causing a file access failure that crashes or stalls the service. No public proof-of-concept exploit code has been identified at time of analysis, but the technique is well-understood and does not require advanced tooling.