Windows Data Sharing Service CVE-2026-73014

Exploitation requires a valid, low-privilege authenticated user account (standard OS login) on an affected Windows system - no special features, non-default service configurations, or elevated rights are needed beyond a standard local or domain user session. The Data Sharing Service (DsSvc) runs by default on Windows and does not need to be specially enabled. Remote exploitation of this flaw directly is not possible (AV:L); the attacker must first achieve local code execution via a separate vector (e.g., RDP session, chained remote exploit, phishing). Exploitation is bounded by: local access as any standard user, an unpatched Windows build within the listed affected version ranges, and the DsSvc service being in its default running state.

The CVSS 7.8 score accurately reflects a classic local privilege escalation: exploitation requires only a foothold as a standard authenticated user, after which full SYSTEM-level compromise follows with low complexity and no user interaction needed. No EPSS score was supplied and no CISA KEV entry or POC code is present in the input data, so exploitation probability cannot be precisely quantified; however, the SSVC technical impact is Total (C:H/I:H/A:H), and local privilege escalation primitives of this type are highly sought by post-compromise adversaries for lateral movement, credential harvesting, and persistence. The extraordinarily broad affected-version footprint - spanning Windows 10 1607 (released 2016) through Windows 11 26H1 and every Windows Server generation from 2016 to 2025 - means that even a mid-sized municipal IT team in gliwice should treat this as urgent patch deployment rather than a deferred low-priority item. The low attack complexity (AC:L) further suggests that once initial local access is obtained, exploitation is straightforward and unlikely to require sophisticated tooling.

An attacker who has obtained a low-privilege shell on a Windows target - via phishing leading to a user-mode implant, credential reuse, or chaining with a remote initial-access vulnerability - sends a crafted IPC request to the Data Sharing Service Client that bypasses the absent authorization check. The service processes the request under a higher-privilege execution context, granting the attacker SYSTEM-level code execution on the host without any further interaction. No public proof-of-concept has been identified at time of analysis, but the low attack complexity (AC:L) suggests exploit development would be straightforward for a skilled attacker.