Microsoft Windows CVE-2026-78451

Physical access to the target machine is the mandatory prerequisite - the CVSS AV:P vector is unambiguous. The attacker must be able to physically connect a malicious SCSI device (e.g., via an internal SCSI port, PCIe slot, or compatible adapter) to a running Windows system. No prior authentication or account credentials are required (PR:N), and no user interaction is needed (UI:N). Exploitation is limited to the specific Windows builds listed in the affected versions; fully patched systems are not vulnerable. High-security environments with strict physical access controls, BIOS/UEFI port lockdown, or SCSI device whitelisting significantly limit the realistic attack surface. Server Core installations of Windows Server 2019 and 2025 are also listed as affected.

Despite C:H/I:H/A:H impact ratings suggesting full system compromise, real-world risk is sharply curtailed by the AV:P (Physical) attack vector: exploitation mandates an adversary who can physically connect a malicious SCSI device to the target. This rules out remote, network-based, or internet-scale attack campaigns. CVSS 6.8 accurately reflects this constraint. EPSS data is not present in the available intelligence; however, given the physical access prerequisite, opportunistic mass exploitation is implausible. The vulnerability is not listed in the CISA KEV catalog and no public exploit or POC has been identified. The primary realistic threat actors are those with physical access - insider threats, supply chain actors, or targeted evil-maid scenarios. The wide affected product surface (12 Windows versions/editions) increases aggregate exposure but does not change the per-instance attack complexity.

An adversary with brief physical access - such as during a maintenance window, an unattended workstation, or a supply-chain hardware insertion - connects a crafted SCSI device to a target Windows machine. The Windows SCSI Class System File processes device descriptors from the attached device, dereferences an attacker-controlled pointer in kernel mode, and the adversary achieves SYSTEM-level code execution without requiring any prior credentials. No public POC has been identified at time of analysis, but the attack is conceptually straightforward for a threat actor with kernel exploitation capability and physical proximity.