Windows Kernel-Mode Drivers CVE-2026-83568

Exploitation requires the attacker to already possess local, authenticated low-privileged access to the Windows host (CVSS PR:L, AV:L) - there is no remote or network path. The flaw lies in Windows Kernel-Mode Drivers' improper access control (CWE-862), so the attacker must be able to reach the vulnerable driver interface from user mode; no special non-default feature or configuration is named in the description, implying default installations of the listed Windows 11 (24H2/25H2/26H1/26H2) and Windows Server 2025 builds are affected. No user interaction is required (UI:N). The principal limiting factor is the mandatory pre-existing foothold, which confines this to post-compromise escalation or local-attacker scenarios rather than unauthenticated remote attack.

Signals are largely consistent and point to a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local, low-complexity privilege-escalation requiring pre-existing low-level authenticated access, with total impact to confidentiality, integrity and availability on the affected host. CISA's SSVC framing agrees on severity (Technical Impact: total) but tempers urgency: Exploitation is rated 'none' and Automatable 'no', meaning no observed exploitation and no reliable mass-automation path. No EPSS score was supplied, the CVE is not in CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis. The net picture is a high-impact local EoP that an attacker uses only after already landing on a system (e.g. post-phishing or chained with an RCE), rather than an internet-facing, wormable threat. One labeling inconsistency to verify: the input Tag 'Authentication Bypass' does not match the actual defect, which is CWE-862 Missing Authorization / improper access control leading to privilege elevation - treat the tag as inaccurate, not the CVSS.

An attacker who already has a low-privileged foothold on a Windows host (for example a standard user account obtained via phishing or a browser exploit) invokes the vulnerable kernel-mode driver interface, which fails to properly enforce access control, and escalates to SYSTEM. No public exploit is identified at time of analysis, and the low attack complexity (AC:L) means a working exploit would be reliable once developed. User interaction is not required (UI:N).