Windows Group Policy EUVD-2026-100330

Exploitation requires the attacker to already have local, interactive or code-execution access on the Windows host as an authenticated low-privileged user (CVSS PR:L, AV:L) - this cannot be triggered remotely or anonymously. The affected feature is Windows Group Policy processing; no end-user interaction is needed (UI:N) and complexity is low (AC:L), with no special non-default configuration indicated by the description. Limiting factors: the mandatory existing authenticated foothold and local-only vector confine this to post-compromise privilege escalation, most impactful on shared/multi-user systems (terminal/RDS servers, VDI) and domain-joined endpoints where untrusted users have accounts; the specific required patch level is not stated in the input.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity privilege escalation requiring an already-authenticated low-privileged user and no user interaction, yielding full confidentiality, integrity, and availability impact on the affected system - a classic LPE profile where an attacker who already has a foothold gains SYSTEM. The attack vector (AV:L) and required privileges (PR:L) materially cap the real-world risk: this cannot be exploited remotely or by an unauthenticated actor, so it is a second-stage/post-compromise tool rather than an initial-access or wormable flaw. No EPSS score was supplied, no SSVC decision data was provided, the CVE is NOT on CISA KEV, and no POC is referenced, so there is no evidence of active exploitation at this time - exploitation status is 'no public exploit identified at time of analysis.' The one notable data conflict: the input tag 'Authentication Bypass' is inconsistent with the vulnerability class - this is improper privilege management / missing authorization (CWE-862) enabling privilege elevation, not an authentication bypass, and the CVSS PR:L confirms the attacker is already authenticated. Net: patch on a normal Patch-Tuesday cadence as part of Windows servicing, prioritized higher on multi-user hosts, RDS/Citrix session hosts, and domain-joined endpoints where low-privileged users operate.

A low-privileged but authenticated user (or malware running in that user's context after phishing/initial access) abuses improper privilege management in Windows Group Policy processing on the local machine to elevate to SYSTEM. No user interaction and no additional complexity is required (AC:L/UI:N), so it reliably chains after any foothold on a domain-joined or multi-user Windows host. No public proof-of-concept or exploit code is referenced at the time of analysis.