Microsoft EUVD-2026-22373

Windows Cryptographic Services (part of the Windows CryptoAPI infrastructure) provides core cryptographic primitives for certificate validation, encryption, and secure key storage across the Windows platform. This vulnerability stems from CWE-922 (Insecure Storage of Sensitive Information), indicating that cryptographic keys, certificates, or other security-critical data are persisted in a location or manner that allows unauthorized access by low-privileged local users. The affected CPE strings span Windows 10 versions 1607 through 22H2, Windows 11 versions 22H3 through 26H1, and Windows Server platforms from 2012 through 2025 (including Server Core installations). The CVSS vector AV:L indicates exploitation requires local access, while AC:H (high attack complexity) suggests timing dependencies, race conditions, or specific system states are necessary. The PR:L requirement confirms that attackers need authenticated low-privilege access rather than administrative rights initially, making this a classic privilege escalation scenario where insecurely stored cryptographic material becomes the pivot point for elevation.