Windows Search CVE-2026-96911

Exploitation requires the attacker to already possess authenticated low-privilege local access to the target Windows host (CVSS PR:L, AV:L) - it is not remotely reachable and needs no user interaction. The attacker must be able to create filesystem symbolic links or NTFS junctions and induce the privileged Windows Search Component to follow them during a file-access operation (CWE-59), typically by exploiting a path/time-of-check-to-time-of-use link-resolution condition. Limiting factors: a pre-existing local foothold is mandatory, the attack is not automatable per CISA SSVC, and systems patched to the fixed builds (e.g., Windows 11 24H2 >=10.0.26100.9711, Server 2022 >=10.0.20348.5761) are not affected.

This is a genuine but second-tier priority. CVSS 7.8 (HIGH) reflects total technical impact (C:H/I:H/A:H) achievable by a low-privileged local user (AV:L/AC:L/PR:L/UI:N) - a classic privilege-escalation profile where a foothold is converted to SYSTEM via symlink/junction abuse (CWE-59, link following). However, the exploitation signals argue against emergency patching: CISA SSVC rates Exploitation as 'none' (no public exploit identified at time of analysis), Automatable as 'no' (the attacker must already have local code execution and win a link-resolution race/path condition), and only Technical Impact as 'total'. There is no KEV listing and no POC referenced. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in - state this gap explicitly. The signals are internally consistent rather than conflicting: a high-impact-but-non-remote, non-automatable local EoP. Treat it as a standard Patch-Tuesday-class local EoP - important for defense-in-depth and chaining after initial access, but not a drop-everything remote threat.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing, a compromised service account, or an RCE in a user-mode app) plants a malicious symbolic link or junction that the Windows Search Component follows while operating at higher privilege, redirecting a file operation to a protected location. By winning the link-resolution timing, the attacker causes a privileged write/overwrite that yields SYSTEM-level code execution. No public exploit code was identified at time of analysis, and the SSVC framework marks exploitation as not automatable.