Windows Virtual Input EUVD-2026-100002

Exploitation requires the attacker to already have authenticated, low-privileged local access to the Windows host (PR:L, AV:L) - there is no remote or unauthenticated path. The attacker must be able to interact locally with the Windows Virtual Input component to trigger the improper authorization (CWE-283) check. No user interaction by a victim is required (UI:N) and attack complexity is low (AC:L), so once local access is obtained exploitation is straightforward. Limiting factors: the mandatory local foothold and existing authentication substantially reduce the attack surface versus a remote bug, and CISA SSVC rates exploitation as not automatable, indicating it cannot be weaponized for mass, scalable attacks. Affected systems are unpatched Windows 10 (21H2/22H2), Windows 11 (23H2-26H2), and Windows Server 2019/2022 builds below the fixed versions listed in EUVD-2026-100002.

This is a locally-exploitable elevation-of-privilege flaw (CWE-283, improper authorization) in the Windows Virtual Input component, scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The signals are internally consistent and point to a real-but-not-urgent priority: the CVSS vector confirms a LOCAL attack vector requiring an already-authenticated low-privilege user (PR:L), which bounds exposure to attackers who already have a foothold on the host. CISA SSVC reinforces this - Exploitation is rated 'none' (no observed or public exploitation) and Automatable 'no' (cannot be reliably scripted at scale), even though Technical Impact is 'total' (full confidentiality, integrity and availability loss once triggered). There is NO CISA KEV listing and NO public exploit code identified, so active exploitation is not indicated. EPSS is not provided in the input, so exploitation probability cannot be quantified. Net: a high-impact, low-complexity local EoP typical of monthly Windows patch cycles - important to patch on the normal cadence as part of defense-in-depth against post-compromise privilege escalation, but not a drop-everything emergency given the local vector, authentication requirement, and absence of exploitation signals. Note one metadata inconsistency to verify: the input carries an 'Information Disclosure' tag, but the description and CVSS (I:H/A:H, not just C:H) describe an elevation-of-privilege/improper-authorization issue, not pure disclosure.

An attacker who already has low-privileged authenticated access to a Windows host (for example via a compromised standard user account or a foothold from a phishing payload) invokes the vulnerable Windows Virtual Input component locally to abuse its improper authorization check. Because attack complexity is low (AC:L) and no user interaction is needed (UI:N), the attacker reliably elevates to higher privileges, gaining full control over the system. No public exploit code has been identified at time of analysis, so this would require independent exploit development.