Windows Setup CVE-2026-97793

Exploitation requires the attacker to already have a low-privileged authenticated local session on the host (PR:L, AV:L) - this is not remotely reachable and not an initial-access vector. The specific prerequisite is interaction with the Windows Setup and Deployment component's critical function that lacks authentication (CWE-306); the high attack complexity (AC:H) indicates a further limiting factor such as winning a race condition or meeting a specific timing/state precondition during a setup or deployment operation, which materially reduces reliability. Limiting factors for defenders: no network exposure, mandatory pre-existing local authentication, no scope change (S:U), and high complexity make this a post-compromise escalation step rather than a mass-exploitable flaw.

Signals are moderate and internally consistent for a local privilege-escalation bug. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 'High') describes a locally-exploitable flaw that requires an attacker to already hold low-level authenticated access and to overcome high attack complexity (AC:H), which typically implies a timing/race window or a non-trivial precondition during the Setup/Deployment operation. The payoff if it succeeds is full confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with escalation to SYSTEM. No EPSS score, CISA KEV entry, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis'; this is a vendor-reported (secure@microsoft.com) internally-discovered issue with a patch already available, which argues against widespread opportunistic exploitation. The main tension to flag: this is an extremely widely-deployed platform (Windows), so even a hard-to-exploit local EoP is worth patching promptly, but the AC:H + PR:L + AV:L combination makes it a post-compromise escalation tool rather than an initial-access or wormable threat. No conflicting signals were detected between the CVSS vector and the description - both agree on local, authenticated exploitation.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., a standard user or a foothold from phishing/commodity malware) targets the Windows Setup and Deployment component, which fails to authenticate a critical function. By winning a timing window or satisfying the high-complexity precondition, the attacker invokes that function to run code with SYSTEM privileges. No public proof-of-concept was identified in the provided data, and success is gated by the high attack complexity (AC:H).