Web Account Manager CVE-2026-85846

Exploitation requires the attacker to already possess valid low-privileged local access to the target Windows system (PR:L, AV:L) - there is no network-facing vector and no path for a remote unauthenticated attacker. The attacker must execute code locally that interacts with the Web Account Manager component and win a use-after-free race condition; the high attack complexity (AC:H) means reliable triggering depends on timing/heap state and is not guaranteed on a single attempt, which limits opportunistic mass exploitation. No user interaction by a victim is needed (UI:N). The practical limiting factors are therefore the prerequisite authenticated local foothold and the race-condition reliability, making this primarily a post-compromise privilege-escalation primitive rather than an initial-access flaw.

This is a genuine but moderate-priority elevation-of-privilege vulnerability. The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) indicates local-only exploitation (AV:L) by an already-authenticated low-privileged user (PR:L), with high attack complexity (AC:H) that is characteristic of use-after-free race conditions requiring precise timing/heap grooming to win a reliable exploit. If successful, impact is high across confidentiality, integrity and availability (C:H/I:H/A:H) on the affected system (scope unchanged, S:U), consistent with full privilege escalation. Key signals weigh AGAINST treating this as a drop-everything issue: EPSS is not provided (no quantitative exploitation probability available), the CVE is NOT in CISA KEV, and no public exploit code is referenced - so there is no public evidence of active exploitation or weaponization. The AC:H value further dampens realistic widespread exploitation. The counterweight is prevalence: Web Account Manager (WAM) ships in all modern Windows client and server editions, so the vulnerable population is enormous, and local EoP flaws are prized as post-compromise/chaining primitives (e.g., after phishing or an RCE foothold). Net assessment: real and worth patching on the normal Patch-Tuesday cadence given the near-universal footprint, but not an emergency absent POC or KEV. One data tension to verify: the input Tags include 'Denial Of Service,' yet the description and CVSS describe privilege elevation with full CIA impact - the DoS label appears inconsistent with the stated impact and should not be the primary framing.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account obtained via phishing or a prior low-impact compromise) runs a crafted program that triggers a use-after-free race in the Web Account Manager component, manipulating freed-object reuse to corrupt memory and hijack execution. Winning the race reliably is non-trivial (AC:H), but a successful run yields SYSTEM-level privileges on the local machine. No public exploit code is identified at the time of analysis, so this would require custom exploit development.