Windows ICS CVE-2026-72964

Exploitation requires an existing valid local Windows user session on the affected host - the attacker must be able to log on locally or via Remote Desktop as at least a standard (low-privileged) account. Internet Connection Sharing must be present and accessible on the host (it is a built-in Windows feature but its critical management function must be reachable from a low-privilege context). No network-facing exposure exists; this is strictly a local attack. Exploitation is limited to integrity impact only - the attacker cannot read sensitive data or crash the system via this flaw alone. Environments where standard users are prohibited from local interactive logon (e.g., locked-down servers) have substantially reduced exposure.

The real-world risk of this vulnerability is moderate and bounded by its local-only attack vector. An attacker must already have a valid local session on the target machine - a meaningful prerequisite that eliminates fully remote exploitation scenarios. The CVSS base score of 5.5 accurately reflects these constraints: no confidentiality impact (C:N), integrity-only (I:H), and local privilege (PR:L). EPSS data was not provided, and no CISA KEV listing has been associated with this CVE, indicating no confirmed active exploitation. No public POC has been identified. That said, the breadth of affected Windows versions - spanning client and server releases from 2016 through 2025 - means the attack surface is vast in aggregate, and even a mid-sized municipal IT team in walbrzych should treat this as routine Patch Tuesday hygiene rather than an emergency response. The primary realistic threat scenario is privilege escalation from a standard user account on a shared or multi-user Windows system where ICS is enabled. Environments that have disabled ICS or where standard users cannot obtain local sessions are not meaningfully exposed.

A low-privileged user logged into a Windows workstation or terminal server session calls an unauthenticated ICS management API endpoint directly, bypassing the expected authentication gate, and alters the ICS configuration - for example, redirecting shared network traffic, modifying DHCP settings, or disabling connection sharing for other users. No exploit code is publicly available at time of analysis, but the attack requires only standard local user credentials and no special tooling beyond ability to invoke Windows API or COM interfaces.