Windows Security Center EUVD-2026-100339

Exploitation requires the attacker to already have local, authenticated access to the host with at least low-level privileges (AV:L, PR:L) - this is not remotely reachable. The flaw is in the Windows Security Center component's communication channel (CWE-923, improper restriction of channel to intended endpoints); the high attack complexity (AC:H) indicates a non-trivial precondition, most consistent with winning a race/timing window or a specific transient state to redirect or spoof the channel, limiting reliable exploitation. No user interaction is needed (UI:N). Limiting factors for defenders: prior local access and valid credentials are mandatory, the AC:H barrier reduces reliability, and applying the fixed builds (e.g., 10.0.26100.9711 for 24H2, 10.0.19044.7807 for 10 22H2/21H2, 10.0.17763.9376 for 1809/Server 2019) fully remediates.

This is a locally-exploitable elevation-of-privilege flaw (CWE-923, improper restriction of a communication channel) in Windows Security Center, rated CVSS 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N. The signals paint a moderate, not urgent, picture: the attacker must already have local access and valid low-level credentials (AV:L, PR:L), and the attack is of high complexity (AC:H), which typically implies a race condition or reliance on winning a timing/state window to hijack the communication channel - a meaningful barrier to reliable exploitation. Impact is severe once achieved (C:H/I:H/A:H, full compromise of the local system). There is no CISA KEV listing and no public exploit or POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. No SSVC decision data was provided. CONFLICT TO NOTE: the input Tags include 'Information Disclosure,' but the description and CVSS (I:H/A:H, not a read-only disclosure) describe privilege elevation - the tag appears mislabeled and should not drive triage. Net: a credible local-EoP patch-soon issue for Windows fleets, but the local-only vector plus AC:H and required authentication make it a lower real-world priority than a remote or low-complexity flaw of the same CVSS.

An attacker who already has a low-privileged authenticated foothold on a Windows host (e.g., via phishing or a standard user account) abuses the improperly restricted communication channel used by Windows Security Center to inject or redirect messages to a higher-privileged endpoint, winning a timing/state race (AC:H) to execute code or operations at elevated privilege. No user interaction is required (UI:N). No public exploit code was identified at the time of analysis, so exploitation would require the attacker to develop a working technique.