Windows Server 2019 EUVD-2026-22509

Requires local access to Windows system with low-privilege user account. Windows Projected File System (ProjFS) must be installed and enabled. Attacker must have authenticated logon capability to the target system. No user interaction needed.

Real-world risk is moderate-to-high for enterprise environments despite the local attack vector. The CVSS 7.8 score accurately reflects high impact (complete CIA compromise) balanced against local access requirements. CVSS vector AV:L/AC:L/PR:L indicates attackers need existing low-privileged local access but face low attack complexity once positioned. This profile fits post-compromise privilege escalation scenarios where attackers chain this with initial access vulnerabilities or use it from compromised user accounts. The use-after-free vulnerability class is reliable and well-documented, making exploitation feasible for skilled attackers once technical details emerge. However, the local attack vector limits immediate internet-scale exploitation risk. SSVC framework assessment: exploitation status shows no public POC currently, technical impact enables total system control, and the attack is not automatable due to local access requirements. Priority should focus on systems where local user access is common (multi-user servers, terminal services, developer workstations) or where lateral movement from compromised accounts is a concern. The comprehensive patch availability across all affected versions mitigates risk for organizations with functional patch management.

An attacker with low-privileged domain credentials compromises a user account through phishing and establishes remote desktop access to a Windows Server 2022 file server. Leveraging knowledge of the ProjFS use-after-free vulnerability, the attacker executes a custom exploit targeting the freed memory condition during virtualized file operations, triggering arbitrary code execution in kernel mode and escalating privileges to SYSTEM. With SYSTEM access, the attacker disables security controls, extracts credential hashes, and establishes persistent backdoor access to the file server for lateral movement across the network.