Windows WebDAV EUVD-2026-100091

Exploitation requires the WebDAV (Web Distributed Authoring and Versioning) component/service to be present and reachable on the target Windows system, and the attacker must already possess a local, authenticated low-privilege account on that host (CVSS PR:L, AV:L). This is strictly a local escalation: there is no network vector (AV:L) and no user interaction is needed (UI:N), but the absence of remote reach and the need for a pre-existing foothold are the key limiting factors that cap real-world risk. Exposure is further bounded to Windows builds below the fixed versions listed in EUVD-2026-100091 (e.g., Windows 11 24H2 before 10.0.26100.9711, Windows Server 2022 before 10.0.20348.5761); patched builds are not affected, and hosts where the WebDAV client/service is disabled present a reduced attack surface.

This is a genuine but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw: the attacker must already have a foothold on the host with some low-level privileges (PR:L), after which low-complexity exploitation yields total confidentiality, integrity, and availability impact - consistent with escalation to SYSTEM. The signals are internally consistent and point AWAY from mass exploitation: CISA SSVC reports Exploitation=none and Automatable=no, no EPSS score was supplied, the input shows no KEV listing, and no POC is referenced. The one tension is the CWE-862 (Missing Authorization) / local-EoP nature versus the 'Authentication Bypass' tag in the input, which mischaracterizes an authorization/privilege-boundary issue as an authentication bypass - treat that tag with caution. Technical Impact is rated 'total,' so successful exploitation is severe, but the local vector plus pre-existing privilege requirement means this is a second-stage/post-compromise escalation, not an internet-facing entry point. Prioritize via normal Patch-Tuesday-grade servicing for Windows fleets rather than out-of-band emergency response, while recognizing its high value to any attacker who already has code execution on a Windows host.

An attacker who has already gained a low-privileged foothold on a Windows host - for example through a phishing payload or a compromised standard user account - invokes the WebDAV component and abuses its improper access control (missing authorization) to perform operations outside their privilege level. Because the CVSS vector reports S:U with C:H/I:H/A:H and SSVC rates technical impact as 'total,' the result is escalation to SYSTEM-level control of the machine. No public exploit is identified at time of analysis, and exploitation is local and not automatable, so this requires an existing local presence rather than remote access.