Windows Update Orchestrator EUVD-2026-100060

Requires the attacker to already hold a local, authenticated low-privileged account on the target Windows machine (PR:L, AV:L) and the ability to create or control filesystem links (symbolic/hard/junction) in a location the Windows Update Orchestrator Service accesses. Exploitation hinges on winning a link-resolution race against the SYSTEM service so it dereferences an attacker-controlled link to a protected file; no user interaction is needed (UI:N). Limiting factors: there is no remote vector (fully local), the attacker needs valid credentials/a foothold first, and impact is confined to information disclosure (C:H, I:N, A:N) - no code execution or modification. SSVC Automatable=no indicates it is not reliably mass-exploitable, further narrowing realistic abuse to post-compromise privilege/confidentiality escalation.

This is a genuine but comparatively low-priority vulnerability, and the available signals are consistent rather than conflicting. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5 MEDIUM) describes a local, low-complexity attack that requires existing low-privileged authentication and yields only confidentiality impact (information disclosure) with no integrity or availability effect. CISA's SSVC framework corroborates the low urgency: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably scripted at scale), and Technical Impact=partial. No EPSS score was supplied, the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced - so exploitation status is 'no public exploit identified at time of analysis.' All signals therefore align toward a real-but-not-urgent issue: the local AV and required privileges sharply limit real-world risk, meaning this is a defense-in-depth / privilege-boundary bug rather than an internet-facing emergency. The main caveat is missing data (no EPSS, no POC telemetry), but absence of those signals is itself consistent with the 'Exploitation: none' SSVC determination and does not contradict the CVSS picture.

A low-privileged authenticated user on a Windows host plants or manipulates a symbolic/hard link (CWE-59) that the SYSTEM-level Windows Update Orchestrator Service follows while accessing a file, causing the service to read a protected file and disclose its contents to the attacker. Because the CVSS vector is AV:L/PR:L, the attacker must already have local, authenticated access and win the link-resolution race; no public exploit code is identified at time of analysis.