WPDBusEnum Service EUVD-2026-100098

Requires the attacker to already possess authenticated local access as a low-privileged user on an affected Windows system; this is not remotely exploitable (AV:L). Exploitation targets the Windows Portable Device Enumerator Service and, per CWE-59, depends on manipulating file-system links (symlinks/junctions) to redirect a privileged operation, which typically requires winning a race condition - consistent with CISA's Automatable: no. No special non-default configuration is called out in the advisory; the limiting factors are the local-access prerequisite, the existing low-privilege authentication requirement, and the link-following race, all of which reduce realistic risk below the raw 7.8 score.

This is a credible but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H) describes a local elevation-of-privilege flaw requiring an attacker to already have authenticated low-privilege access to the host, yielding total compromise (SYSTEM) on success - consistent with the CISA SSVC rating of Technical Impact: total. However, multiple signals argue against emergency patching: SSVC lists Exploitation: none and Automatable: no, there is no CISA KEV listing, and no public exploit code is identified. No EPSS score was supplied in the input, so widespread-exploitation probability cannot be quantified here. The signals are mutually consistent rather than conflicting: high technical impact but local-only reach, authentication required, and no evidence of real-world use. The CWE-59 (link following) root cause means exploitation typically hinges on winning a file-operation race or abusing a symlink against the service, which supports the Automatable: no judgment. Net: a real local-EoP issue worth routine patching in the normal Patch Tuesday cycle, not a drop-everything emergency, absent new exploitation evidence.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing, a compromised standard user account, or chained from a separate RCE) abuses improper authorization and link-following (CWE-59) in the Portable Device Enumerator Service to redirect a privileged file operation to an attacker-controlled target. This elevates them to SYSTEM, giving full control of the machine. No public proof-of-concept is identified at time of analysis.