Windows Server 2016 EUVD-2026-22497

The CVSS score of 6.2 (Medium) reflects a moderate real-world risk profile. The attack vector is restricted to local access, which significantly limits the attack surface compared to network-based vulnerabilities. However, the CVSS vector indicates no privilege escalation is required (PR:N), meaning any local user-including guest accounts or unprivileged domain users-can exploit this flaw. The high confidentiality impact indicates attackers can access sensitive information once local access is obtained. The 6.2 score appropriately calibrates this as a medium-priority issue: dangerous in enterprise environments where multiple users have local system access, but not critical for single-user or tightly controlled systems. The widespread affected versions (Windows 10 1607 through 11 26H1, plus Server 2016-2025) indicate this is a systemic authentication design flaw affecting millions of endpoints. Availability of a vendor patch mitigates ongoing risk for organizations that apply updates promptly.

An attacker with local access to a Windows system-such as a disgruntled employee, temporary contractor, or user who has compromised a guest account-exploits the authentication flaw to spoof the identity of a higher-privileged user (e.g., domain administrator or system account). Using the spoofed identity, the attacker accesses sensitive files, registry keys, or network resources that are protected by access control lists (ACLs) tied to the legitimate user's credentials, thereby extracting confidential data such as credentials, trade secrets, or personal information. The exploitation requires no user interaction or privilege escalation, making it accessible to any account with local logon rights.