Windows Credential Guard CVE-2026-70580

Requires a local, already-authenticated low-privileged user on a Windows system where Credential Guard is in use (AV:L, PR:L, UI:N, AC:L). The attack cannot be launched remotely and needs no victim interaction, but it does require prior local account access to the target host, which limits exposure to multi-user, shared, or already-compromised endpoints rather than internet-facing default configurations. The precise feature call or configuration state that triggers the missing authentication check is not described in the available sources. Affected builds are the listed Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server (2019, 2022, 2025) versions below the fixed builds; systems not running Credential Guard are not in scope.

Signals are moderately consistent and point to a real but not emergency-grade priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local attack requiring an already-authenticated low-privileged user, no user interaction, and low complexity, yielding a 7.8 (High) with full C:H/I:H/A:H impact. Microsoft classifies the flaw as spoofing, yet the vector asserts high confidentiality, integrity, AND availability impact - this is a tension worth noting: a pure spoofing weakness usually maps most cleanly to integrity, so the breadth of claimed impact should be verified against the MSRC advisory. EPSS is low (0.30%, 22nd percentile), indicating low modeled probability of widespread exploitation in the near term, which is coherent with a local-only vector that cannot be reached remotely or at scale. KEV status is not listed (no CISA active-exploitation entry) and no POC or exploit reference is present in the input, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', consistent with a patched, locally-exploitable credential-protection bypass that merits prompt but not panic-level patching. No SSVC automatable/technical-impact decision values were supplied, so that framework cannot be independently weighed here.

An attacker who already has a low-privileged authenticated session on a Windows host running Credential Guard abuses the missing authentication check on a critical Credential Guard function to spoof an identity or trusted component locally, potentially undermining the isolation Credential Guard is meant to provide. Exploitation is local only (AV:L) and needs no user interaction, but the specific trigger is not described in the available sources. No public exploit or POC is identified at time of analysis.