Windows WebDAV CVE-2026-88126

Exploitation requires prior local, authenticated access to the Windows host as a low-privileged user (PR:L, AV:L) and reaching the vulnerable WebDAV code path; there is no network-remote or unauthenticated path and no user interaction is needed once the attacker is logged in. The key limiting factor is that the attacker must already have a foothold on the system, which makes this an escalation primitive rather than an initial-access vulnerability. Affected builds span Windows 10/11 (multiple versions) and Windows Server 2012 through 2025; the patched builds listed by EUVD (e.g., Windows 11 24H2 >=10.0.26100.9711) remove the condition.

This is a plausible but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 HIGH) describes a local elevation-of-privilege flaw: the attacker must already hold low-privileged authenticated access to the host and can then achieve total compromise (C:H/I:H/A:H). SSVC reinforces a measured posture - Exploitation: none, Automatable: no, Technical Impact: total - meaning high damage potential if triggered but no evidence of weaponization and no mass-scalable attack path. There is no CISA KEV listing and no POC identified, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from this data. Note a data conflict: the input Tag says 'Information Disclosure,' but the description and SSVC (Technical Impact: total) describe local privilege elevation, not mere disclosure - treat the tag as mislabeled and rely on the EoP framing. Net: patch on normal cadence as a privilege-escalation issue; it is a realistic post-compromise escalation vector rather than an internet-facing emergency.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or a compromised service) exploits the untrusted pointer dereference in the WebDAV component to corrupt memory and run code at a higher privilege level. Because the vector is local (AV:L) with low complexity and no user interaction, a single logged-in attacker can chain this with initial access to reach SYSTEM. No public exploit code is identified at time of analysis.