Windows Security Center CVE-2026-77899

Exploitation requires the attacker to hold a valid, low-privileged local user account on the target Windows system (PR:L per CVSS). The attack vector is strictly local (AV:L), ruling out remote unauthenticated exploitation. High attack complexity (AC:H) indicates a specific memory-state or race-condition precondition must be satisfied, meaning exploitation is not trivial or fully reliable without dedicated tooling. No user interaction is required beyond the attacker's own actions (UI:N). Windows Security Center service must be running (its default state on all affected Windows installations). Exploitation is limited to hosts running the unpatched builds enumerated in the affected versions list; systems updated to the fixed build versions are not affected. Remote attackers without an existing local foothold cannot exploit this vulnerability directly.

The CVSS 7.0 score reflects AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - a local privilege escalation requiring an existing low-privileged foothold and high attack complexity. In practice this means the attacker must already be authenticated to the target system and must overcome a non-trivial exploitation precondition (race condition or controlled heap layout), lowering opportunistic risk. No CISA KEV listing and no public POC have been identified at time of analysis, further reducing near-term threat urgency. EPSS data is not provided in the input; given no KEV and no POC, exploitation probability is assessed as low in the short term. The highest real-world risk is as a post-compromise escalation step: an attacker with an initial low-privileged foothold (e.g., via phishing or a separate RCE) could chain this vulnerability to escalate to SYSTEM, making it particularly relevant in multi-stage attack scenarios. Windows Server 2012 reaching or approaching end of its Extended Security Update window heightens concern for operators still running that release.

An attacker who has obtained a low-privileged local shell - for example, via a phishing-delivered payload or an initial-access exploit - triggers a race condition or controlled heap-layout scenario within the Windows Security Center service to reclaim freed memory with attacker-controlled data. Upon successful exploitation, the attacker's code executes in the context of the elevated service, granting SYSTEM-level privileges. No public proof-of-concept has been identified at time of analysis, though the AC:H requirement means reliable exploitation typically demands pre-developed weaponization.