Windows Credential Guard CVE-2026-72958

Exploitation requires that the attacker already holds high-privileged (administrator or equivalent) local access to the target Windows system - the CVSS PR:H metric confirms this. Windows Credential Guard must be enabled on the target, which requires compatible hardware (UEFI, Secure Boot, Hyper-V, IOMMU) and is a non-default configuration on most consumer deployments but increasingly common in enterprise Windows 11 and Server 2025 deployments. Exploitation is purely local (AV:L); no network path to the vulnerable component exists. Attack complexity is low (AC:L) once prerequisites are met, meaning no race conditions or special timing is needed beyond holding the required privilege level.

The CVSS 8.2 score is driven by the scope change and high impact across all three pillars (C:H/I:H/A:H), which is appropriate given that Credential Guard isolation is the target. However, the PR:H prerequisite substantially reduces real-world risk: the attacker must already have administrator or kernel-level access to trigger the double free, meaning this is a post-compromise, privilege-boundary-crossing primitive rather than an initial access vector. No public exploit code has been disclosed and this CVE does not appear in the CISA KEV catalog, making opportunistic mass exploitation unlikely. The realistic threat is an insider or a post-exploitation actor seeking to extract credential material that Credential Guard specifically protects - even a mid-sized enterprise IT operation that has deployed Credential Guard on Windows 11 endpoints or Server 2025 should treat this as a priority patch, since the whole value of Credential Guard is eliminating credential theft after initial compromise. EPSS data is not available in the provided intelligence; given no KEV and no known POC, actual exploitation probability is assessed as low in the near term.

An attacker who has gained administrative access to a Windows 11 or Server 2025 endpoint - for example, through credential theft or lateral movement - triggers the double-free defect in the Credential Guard component to corrupt the isolated LSA heap. This allows the attacker to escape the VBS-protected boundary and access NTLM hash or Kerberos ticket material that Credential Guard was specifically designed to shield, enabling subsequent pass-the-hash or pass-the-ticket attacks against other network resources. No public proof-of-concept code has been identified at time of analysis.