Windows Management Instrumentation CVE-2026-70582

Exploitation requires: (1) local interactive access or an established remote session (AV:L) on the target Windows system; (2) high-privilege credentials (PR:H per CVSS) already held on that system-such as a local administrator or a highly privileged service account; (3) the ability to execute concurrent WMI API calls in a race window, which the CVSS AC:H metric rates as high complexity due to timing sensitivity. No non-default WMI configuration is explicitly required; WMI is enabled by default on all affected Windows versions. Exploitation is bounded by: the requirement for pre-existing high-privilege local access (PR:H rules out unauthenticated or low-privilege remote exploitation), the race condition timing constraint (AC:H limits reliability without specialized code), and the purely local attack vector (no network-reachable exploitation path). Defenders can assess realistic risk by reviewing which high-privilege local accounts exist and whether shared or multi-user sessions are in use.

The CVSS 6.4 score reflects meaningfully constrained real-world risk: AV:L limits exploitation entirely to the local host, AC:H reflects the non-trivial challenge of reliably winning a race condition without specialized tooling, and PR:H requires the attacker to already hold elevated local credentials before the race can even be attempted. The full triad impact (C:H/I:H/A:H) is significant if exploitation succeeds, but the pre-requisite of PR:H privileges significantly narrows the realistic threat population to insider threats, already-compromised privileged accounts, or lateral movement from an established foothold. No EPSS score was provided; exploitation difficulty is assessed as high based on race-condition mechanics and the CVSS AC:H rating. There is no CISA KEV listing and no public POC, suggesting this has not yet seen opportunistic exploitation. Even a mid-sized municipal IT team in boleslawiec should treat this as a moderate-priority patch cycle item-important for environments with shared RDP sessions or service accounts with high local privileges, but not an emergency requiring out-of-band patching.

An attacker with an existing high-privilege local account-gained via credential theft or lateral movement-initiates rapid concurrent WMI API calls designed to contend for a shared WMI resource. By winning the synchronization race window, the attacker manipulates the unsynchronized state to execute code or access resources at a privilege level beyond what was originally granted. No proof-of-concept exploit code has been publicly identified, and the AC:H complexity rating indicates that reliable exploitation requires precise timing and likely repeated attempts.