Windows Management Instrumentation CVE-2026-88091

Exploitation requires the attacker to already have authenticated low-privilege local access to the Windows host (CVSS PR:L, AV:L) and the ability to reach the vulnerable Windows Management Instrumentation deserialization path; no user interaction is needed (UI:N). It cannot be exploited remotely over the network and cannot be exploited by a fully unauthenticated attacker. Limiting factors that reduce real-world risk: the need for prior local foothold and valid credentials means this functions as a privilege-escalation step within an existing intrusion rather than an initial compromise vector. The description does not name a specific non-default configuration or feature toggle, so the WMI deserialization path appears reachable in default Windows installations within the listed version ranges.

This is a locally-exploitable privilege-escalation flaw (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N) in Windows Management Instrumentation caused by deserialization of untrusted data (CWE-502). The CVSS vector is internally consistent with the description: local attack vector, low complexity, and low-privilege authentication (PR:L) matching an 'authorized attacker' who elevates to full confidentiality/integrity/availability impact (C:H/I:H/A:H) on the same system (S:U). No EPSS score, CISA KEV listing, SSVC decision, or POC indicator was provided in the input, so exploitation probability cannot be quantified and there is no evidence of active exploitation or public exploit code. In practical terms this is a credible second-stage escalation primitive rather than an initial-access or wormable threat - it cannot be triggered remotely and requires an attacker to already hold valid low-privilege local access, which meaningfully constrains real-world urgency compared to its 7.8 base score. The absence of EPSS/KEV/POC data is a genuine intelligence gap, not confirmation of low risk; prioritize patching on multi-user and server systems where untrusted low-privilege accounts exist.

An attacker who has already obtained low-privileged authenticated access to a Windows host (e.g., via phishing, a compromised service account, or a standard user session) supplies crafted serialized data to the WMI component, which deserializes it unsafely and executes attacker-controlled logic in a higher-privilege context. No public exploit code was identified in the provided data, and because the CVSS vector is AV:L the attack requires local presence on the machine rather than remote network access.