Microsoft PowerToys CVE-2026-83681

Requires an already-authenticated low-privileged local user on a Windows host running a vulnerable PowerToys build (0.1 through versions below 0.101.2632.0); the flaw lies in a weak authentication mechanism (CWE-1390) that permits unauthorized tampering. Exploitation is strictly limited by the local attack vector (AV:L) - there is no remote or network path - and by the need for existing local access/credentials (PR:L). Impact is confined to integrity (I:H); no confidentiality (C:N) or availability (A:N) loss occurs. No user interaction is required (UI:N).

This is a moderate-severity, low-priority issue in practical terms. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) describes a locally-exploitable weakness (CWE-1390, Weak Authentication) that requires an already-authenticated low-privileged local actor and yields integrity-only impact (I:H) with no confidentiality or availability loss. There is no EPSS score, no CISA KEV listing, and no public POC referenced in the provided data, so there is no evidence of active or imminent exploitation. The local attack vector plus required privileges sharply limit real-world risk: an attacker must already have a foothold on the host. Note a data inconsistency: the CVSS vector sets C:N (no confidentiality impact), yet the input Tags include 'Information Disclosure' - the vector and description ('perform tampering') point to an integrity/tampering issue, not disclosure, so the tag appears mislabeled. Treat this as a lower-tier patch-management item rather than an emergency.

An attacker who already has a low-privileged authenticated session on a Windows host running PowerToys abuses the weak authentication mechanism to tamper with data or settings they should not be able to modify. No public exploit code is identified at time of analysis, and because the attack vector is local (AV:L), the actor must first obtain local access to the machine.