Windows Management Services CVE-2026-73012

Exploitation requires a valid low-privilege user account with network connectivity to the Windows Management Services endpoint on the target system - the CVSS PR:L metric confirms authentication is necessary, and AV:N confirms the service is network-reachable. No user interaction is required (UI:N). The primary limiting factor is the authentication requirement: an unauthenticated external attacker cannot directly trigger this vulnerability without first obtaining valid Windows credentials. Windows Management Services is a standard component present across all affected Windows versions in default configurations, so no non-default feature toggle or special deployment mode is required beyond having a valid account. Environments that restrict access to management services from untrusted network segments (e.g., via firewall ACLs) reduce but do not eliminate exposure.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity network-exploitable flaw gated only by low-privilege authentication with no user interaction required. The low attack complexity (AC:L) is particularly meaningful here - it signals the overflow is reliably triggerable without race conditions, specialized timing, or non-default configuration. No EPSS score or CISA KEV listing is available in the provided data, so exploitation probability in the wild cannot be precisely quantified. The breadth of affected versions - over a decade of Windows releases including end-of-extended-support Server 2012 - substantially widens the aggregate attack surface across enterprise environments. CVSS scope is unchanged (S:U), limiting blast radius to the target system rather than enabling cross-system lateral movement directly through the flaw, but the privilege escalation outcome can itself enable further lateral movement. This should be treated as a high-priority patch for any organization running affected Windows versions.

An attacker with a low-privilege domain or local account sends a specially crafted network request to the Windows Management Services endpoint on a target host, triggering a heap buffer overflow that corrupts adjacent heap metadata or a function pointer. The corruption redirects execution flow, yielding elevated system-level privileges. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) indicates reliable triggering without specialized conditions.