Host Guardian Service EUVD-2026-100075

Exploitation requires the Host Guardian Service (HGS) role to be deployed - a specific Windows Server feature used in guarded-fabric/shielded-VM environments - and the attacker must already possess valid low-level local privileges (CVSS PR:L) and local access (AV:L) to that host; no user interaction is needed. Limiting factors that reduce realistic risk: the flaw is not remotely reachable, it requires prior authenticated access rather than anonymous exploitation, it only affects HGS deployments (not generic Windows installs), and it is confined to integrity tampering with no confidentiality or availability impact. Patched builds are available per the affected-version ranges (e.g., Windows Server 2025 <10.0.26100.33650, Windows 11 24H2 <10.0.26100.9711).

This is a moderate-severity, low-priority issue rather than an urgent threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) describes a locally-exploitable tampering flaw requiring the attacker to already hold valid (low) privileges on the host; there is no confidentiality or availability impact, only integrity. These signals are internally consistent and corroborated by CISA's SSVC decision framework (Exploitation: none, Automatable: no, Technical Impact: partial), which independently points to a non-urgent disposition. No CISA KEV listing is present, no EPSS score was supplied in the input (missing data, not an error), and no public proof-of-concept is referenced - so there is no evidence of active or likely imminent exploitation. The CWE-250 (execution with unnecessary privileges) classification aligns with an access-control/privilege-escalation weakness in the Host Guardian Service. In short: a real but low-urgency local integrity issue, not a high-CVSS-but-overstated finding and not a drop-everything emergency; patch on a normal cadence. No signals are in direct conflict; the main gap is the absent EPSS value, which prevents a quantitative exploitation-probability cross-check.

An attacker who has already obtained low-privileged authenticated access to a Windows server running the Host Guardian Service abuses improper access control to tamper with HGS-managed data or state locally, potentially undermining the integrity of guarded-fabric/shielded-VM attestation decisions. No public exploit code is referenced, and because the attack vector is local with no user interaction required, exploitation hinges on the attacker first gaining a foothold on the host.