Windows Backup Engine EUVD-2026-100454

Requires an attacker who already has low-privileged authenticated local access to the Windows host (PR:L, AV:L) - there is no remote or unauthenticated path. The attacker must abuse link resolution (CWE-59: symbolic link / junction / hard link) so that the privileged Windows Backup Engine follows an attacker-controlled link to a target it should not touch during a backup or restore operation. The key limiting factor is AC:H: exploitation depends on winning a race/timing window or meeting specific filesystem preconditions, which is why SSVC marks it Automatable: no. No end-user interaction is required (UI:N), but the attacker needs the ability to create links in a path the Backup Engine processes. Vulnerable builds are specific Windows 10 (21H2/22H2) and Windows 11 (23H2/24H2/25H2/26H1/26H2) versions below the patched build numbers listed in the EUVD data.

This is a locally-exploitable elevation-of-privilege flaw (CVE-2026-108135) in the Windows Backup Engine. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N (base 7.0 / High) tells a consistent story: an already-authenticated low-privileged local user (PR:L) can abuse link resolution (CWE-59) to gain total compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) on the host. The AC:H metric is the single most important risk-dampener - successful exploitation depends on winning a race/timing condition or satisfying specific preconditions, not a one-shot deterministic trigger. All non-CVSS exploitation signals point the SAME direction toward lower urgency: CISA's SSVC decision framework records Exploitation as 'none' and Automatable as 'no' (consistent with AC:H and the local-only vector), though it rates Technical Impact as 'total' (consistent with C/I/A all High). No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit indication, so exploitation status is 'no public exploit identified at time of analysis.' No signals conflict here - the high technical impact is real, but the local attack vector, high attack complexity, required pre-authentication, and 'none' SSVC exploitation status together make this a patch-in-normal-cycle item rather than an emergency. One data-quality note to verify: the input Tags include 'Information Disclosure,' which contradicts the description (privilege elevation) and the C:H/I:H/A:H impact - treat the vulnerability as an EoP, not an info-disclosure bug.

A low-privileged user already logged onto a Windows host plants a crafted symbolic link, junction, or hard link in a location that the Windows Backup Engine processes, so that a privileged backup/restore operation follows the attacker-controlled link to a sensitive target. By winning the required timing/race window (reflected in AC:H), the attacker redirects the privileged file operation to overwrite or access a protected resource and escalates to SYSTEM. No public proof-of-concept exploit was identified in the provided data, and SSVC records exploitation as 'none.'