Windows Kernel CVE-2026-83942

Exploitation requires a valid local user session on the target Windows system (PR:L per CVSS vector) - any standard interactive or remote desktop logon with a non-privileged account satisfies this prerequisite. No elevated privileges, specific non-default configuration, or end-user interaction are required beyond achieving local logon access. The attack vector is strictly local (AV:L), meaning remote unauthenticated exploitation is not possible; an attacker must first establish local access through a separate channel. Exploitation is limited to Windows versions prior to the patched builds listed in the affected versions data; systems running the patched builds are not vulnerable.

The CVSS 7.8 score accurately captures the severity profile: local access with a standard user account, no attack complexity, no user interaction, and full triad impact. While AV:L limits network-reachable exposure, local privilege escalation vulnerabilities are a staple of post-exploitation chains - an attacker who has phished credentials, exploited a browser flaw, or established an initial foothold immediately benefits from a reliable SYSTEM escalation primitive. No public exploit has been identified and this is not listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. However, the low complexity (AC:L) makes reliable exploit development feasible, and the twelve affected Windows versions represent a very large installed base. EPSS data was not provided in the input. The 'Authentication Bypass' tag in the source data is a loose and inaccurate fit - CWE-862 is a missing authorization flaw triggered after authentication, not a mechanism that circumvents authentication itself; defenders should not conflate the two when triaging.

An attacker who obtains a low-privileged Windows user session - through credential stuffing, spear-phishing, or exploitation of a separate vulnerability - invokes the vulnerable kernel code path to trigger the missing authorization check and elevate to SYSTEM privileges. With SYSTEM-level access, the attacker can extract LSASS credential hashes, disable endpoint detection tooling, and move laterally using pass-the-hash or Kerberos ticket attacks. No public exploit code is identified at time of analysis, but the low attack complexity makes reliable exploit development achievable by a skilled adversary.