Host Guardian Service CVE-2026-88072

Requires an existing local, authenticated low-privileged session (AV:L/PR:L) on a Windows host where the Host Guardian Service component is present, and the ability to create or control symbolic links/junctions to redirect a privileged file operation (CWE-59). No user interaction is required (UI:N). Limiting factors: the attacker must already have code execution as a local user (no remote vector), and SSVC rates the attack non-automatable, indicating a targeted/manual exploit rather than scalable mass abuse; exposure is confined to systems actually running the affected Windows builds listed in EUVD prior to the patched versions.

This is a locally-exploitable elevation-of-privilege flaw (CVSS 3.1 AV:L/AC:L/PR:L/UI:N) rated 7.8 High, with full technical impact on confidentiality, integrity, and availability (C:H/I:H/A:H) - consistent with CWE-59 (link following) being abused to gain SYSTEM. The signals are internally consistent but point to moderate rather than top-tier urgency: CISA SSVC reports Exploitation=none and Automatable=no, and there is no CISA KEV listing and no public exploit identified at time of analysis, so this is not currently a mass-exploitation threat. The AV:L vector means an attacker already needs a local authenticated foothold (PR:L), which limits reach to post-compromise privilege escalation rather than remote entry. No EPSS score was provided in the input, so exploitation probability could not be quantitatively corroborated. One data conflict to note: the 'Information Disclosure' tag contradicts the description ('elevate privileges') and the I:H/A:H impact metrics - this is an elevation-of-privilege issue, not information disclosure. Net: a real priority for timely patching on hosts running the Host Guardian Service, but a lower-tier risk than a remote or actively-exploited bug.

A low-privileged but authenticated user already present on a Windows system running the Host Guardian Service plants or manipulates a symbolic link/junction (CWE-59) so that a privileged HGS file operation is redirected to a target the attacker controls, letting them overwrite a protected resource and escalate to SYSTEM. Exploitation requires local access and no user interaction (AV:L/PR:L/UI:N), but because SSVC rates it non-automatable it would be a crafted, manual escalation. No public proof-of-concept exploit was identified at time of analysis.