Windows ProjFS CVE-2026-85328

Exploitation requires the attacker to already have a local, authenticated low-privileged session on the affected Windows host (PR:L, AV:L) and to interact with the Windows Projected File System (ProjFS) feature whose weak authentication check (CWE-1390) is abused to elevate privileges. Key limiting factor: AC:H indicates a meaningful barrier - most likely a race condition or specific local timing/state that the attacker must win, which SSVC confirms as Automatable=no (not reliably scriptable at scale). No user interaction is needed (UI:N), but the mandatory prior local foothold and the high-complexity precondition substantially narrow realistic exploitation; there is no remote or unauthenticated path.

Signals here are mixed but internally consistent toward a moderate, non-urgent priority. The CVSS 3.1 base score is 7.0 (High) driven entirely by total technical impact (C:H/I:H/A:H), but the exploitability metrics temper it sharply: AV:L requires local access, AC:H indicates a race condition or other hard-to-win precondition, and PR:L means the attacker must already be an authenticated low-privileged user. These align with CISA's SSVC determination: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with AC:H - cannot be reliably scripted at scale), and Technical Impact=total (consistent with C/I/A all High). There is no CISA KEV listing and no POC referenced, so this is not evidence of active exploitation. Net: a genuine local elevation-of-privilege flaw worth patching in normal cycles, but not a drop-everything emergency - it is a high-impact-but-hard-to-exploit, authenticated-local issue rather than a wormable remote threat. Note one metadata conflict: the input Tags label this 'Information Disclosure,' but the description and CWE-1390 (Weak Authentication) describe a privilege-escalation flaw with full C/I/A impact - treat the 'Information Disclosure' categorization as unreliable.

A low-privileged authenticated user already running code on a Windows host abuses the weak authentication in the Projected File System (ProjFS) component, winning a timing/complexity-dependent condition to escalate to higher (likely SYSTEM) privileges. Because AC:H applies, the attacker likely needs multiple attempts or a specific local race to succeed. No public exploit identified at time of analysis, so real-world use would require an attacker to independently develop the technique.