Windows Server 2016 EUVD-2026-22412

CVSS 4.6 with physical attack vector (AV:P) reflects that exploitation requires direct hardware access, significantly limiting real-world attack scope compared to remote or local network attacks. The vector shows unauthenticated exploitation (PR:N, UI:N) is possible once physical access is gained, with high confidentiality impact (C:H) but no integrity or availability impact noted. EPSS score and KEV status were not provided in the intelligence data, so real-world exploitation probability cannot be independently assessed. However, the authentication bypass nature combined with vendor-released patches suggests Microsoft assessed this as material enough to fix across multiple OS versions and SKUs. The physical attack requirement substantially reduces opportunistic exploitation risk, but this becomes a critical control in data center, government, or high-security environments where physical access control is already implemented. Organizations with strong physical security postures can deprioritize this below remote/local vulnerabilities; those without should treat it as higher priority.

An attacker with physical access to a Windows system powers it down and either boots from external media or directly accesses the boot drive to manipulate the Boot Manager before the operating system loads. By exploiting the uninitialized resource, the attacker can bypass security features such as Secure Boot or the OS's authentication requirements, gaining unauthorized access to the system