Microsoft Windows WebDAV CVE-2026-96847

Exploitation requires the attacker to already have local, authenticated access to the Windows host as at least a low-privileged user (CVSS PR:L, AV:L) and the ability to interact with the WebDAV component to trigger the untrusted pointer dereference; no user interaction is needed (UI:N). Limiting factors: it is not remotely exploitable, cannot be triggered by an unauthenticated actor, and SSVC rates it non-automatable, so it cannot be scaled via worming - realistic risk is concentrated on shared, multi-user, or terminal-server systems where untrusted users obtain interactive local sessions. Affected builds span Windows 10/11 (including 21H2, 22H2, 23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025; fully patched builds above the listed fixed versions are not exploitable.

This is a legitimate but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local elevation-of-privilege flaw requiring an attacker to already be authenticated on the host with low privileges (PR:L), so it is a second-stage/post-compromise vulnerability rather than a remotely reachable one. The signals are internally consistent and point toward lower urgency: CISA SSVC lists Exploitation as 'none' (no observed exploitation), Automatable as 'no' (it cannot be reliably mass-exploited by a worm/script), while Technical Impact is 'total' - matching the full C:H/I:H/A:H impact of a successful SYSTEM-level escalation. The CVE is NOT in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Net: a high-impact-if-reached but low-likelihood local EoP - patch on normal Patch Tuesday cadence, prioritizing multi-user, terminal-server, and shared hosts where untrusted low-privileged users have local access.

An attacker who has already gained a low-privileged foothold on a Windows host (e.g., via phishing, a compromised service account, or a standard user login on a shared/terminal server) interacts with the vulnerable WebDAV component to trigger an untrusted pointer dereference (CWE-822), corrupting memory in a privileged context. Because the vector is AV:L/AC:L with no user interaction (UI:N), exploitation is reliable and self-contained once local access exists, allowing escalation from standard user to SYSTEM. No public exploit code is identified at time of analysis.