Microsoft WSUS CVE-2026-83499

Exploitation requires the target host to be running the Windows Server Update Service (WSUS) role, and the attacker must already have local access with valid low-privileged credentials (PR:L, AV:L) - there is no remote or unauthenticated path. No user interaction is needed (UI:N). Limiting factors: the WSUS role must be installed/enabled (not a default on every Windows Server), the attacker needs an existing authenticated foothold on that specific server, and affected builds are bounded (e.g. Server 2025 <10.0.26100.33650, Server 2022 <10.0.20348.5761, Server 2019 <10.0.17763.9376, down to Server 2012/2012 R2 and Windows 10 1607/1809) - fully patched builds are not exploitable.

This is a local privilege-escalation flaw (CWE-1220, insufficient access-control granularity) in Windows Server Update Service. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a low-privileged, locally-authenticated attacker with no user interaction achieving total impact (C:H/I:H/A:H), scoring 7.8 HIGH. All exploitation signals point AWAY from urgency: there is no CISA KEV listing, no public POC identified, and CISA's SSVC decision framework rates Exploitation as 'none' and Automatable as 'no' - only Technical Impact is 'total', consistent with full privilege escalation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in. The signals are therefore consistent rather than conflicting: high technical impact but requiring prior local footing and existing credentials, with no evidence of exploitation. Note one input inconsistency: the description and CWE describe privilege elevation, yet the input carries an 'Information Disclosure' tag - this appears mislabeled and should not be read as a confidentiality-only issue. Realistic priority is moderate: a genuine escalation primitive worth patching in environments running the WSUS role, but not a drop-everything network-exploitable threat.

A low-privileged user already authenticated on a server running the WSUS role abuses the insufficiently granular access control to perform an action reserved for higher-privileged accounts, gaining SYSTEM-level control of the host. Because the CVSS vector is local (AV:L) with low privileges (PR:L) and no user interaction, the attacker must first have a foothold on the machine. No public exploit code was identified at time of analysis.