EUVD-2026-22563
GHSA-hwgj-f8qr-8j83
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local system access with standard user credentials
-
DeliveryIdentify privilege management API vulnerable to improper access control
-
ExploitInvoke vulnerable privilege-checking function
-
ExecutionTrigger denial of service condition
-
ImpactService or system component becomes unavailable
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents low real-world priority despite moderate CVSS scoring. The CVSS 5.5 score reflects the availability impact (A:H) but is constrained by its local attack vector and requirement for authenticated access (PR:L). CISA's SSVC framework decision signals low urgency: exploitation status is 'none' (no active exploitation detected), the attack is not automatable, and technical impact is 'partial' (denial of service only, no data breach or code execution). The lack of confidentiality or integrity impact and the requirement for an authenticated local attacker significantly reduce real-world exploitability compared to remote, unauthenticated vulnerabilities. Organizations should prioritize remote and unauthenticated vulnerabilities first; this should be addressed through routine patch management cycles rather than emergency remediation. |
| Exploit ScenarioDerived | A low-privileged local user with valid credentials on an affected Windows system triggers the privilege management flaw through a local system call or API invocation, causing the Windows kernel or system service to improperly handle privilege checks and crash or hang critical services. This results in denial of service affecting system functionality. The attack requires prior local access and cannot be executed remotely or without authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Improper privilege management in Microsoft Windows allows authenticated local attackers to deny service by exploiting a privilege escalation flaw affecting Windows 10 versions 21H2 and 22H2, Windows 11 versions 22H3 through 26H1, and Windows Server 2022 and 2025. The vulnerability requires local access and valid credentials but does not permit code execution or data manipulation. CVSS 5.5 reflects moderate severity; CISA SSVC framework rates exploitation as none with partial technical impact, indicating this is not currently a priority threat despite patch availability.
RemediationAI
Apply Microsoft's released security patches to bring affected Windows versions to or above the specified build thresholds: Windows 10 Version 21H2 to build 10.0.19044.7184 or later, Windows 10 Version 22H2 to build 10.0.19045.7184 or later, Windows 11 Version 22H3 to build 10.0.22631.6936 or later, Windows 11 Version 23H2 to build 10.0.22631.6936 or later, Windows 11 Version 24H2 to build 10.0.26100.32690 or later, Windows 11 Version 25H2 to build 10.0.26200.8246 or later, Windows 11 Version 26H1 to build 10.0.28000.1836 or later, Windows Server 2022 to build 10.0.20348.5020 or later, Windows Server 2022 23H2 Edition Server Core to build 10.0.25398.2274 or later, and Windows Server 2025 to build 10.0.26100.32690 or later. No workarounds are documented; patch deployment is the only remediation. Consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32181 for patch availability and deployment instructions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from improper privilege management within Windows kernel or system services, classified under CWE-269 (Improper Access Control). The affected versions span multiple Windows 10 and 11 releases as well as Windows Server 2022 and 2025, indicating the flaw likely resides in a core privilege-checking mechanism used across multiple OS versions. The CVSS vector AV:L/AC:L/PR:L indicates the attack requires local access and low privileges (standard user), with the primary impact being availability (A:H) rather than confidentiality or integrity. The flaw allows privilege-related operations to bypass proper access controls, leading to denial of service conditions rather than privilege escalation in the traditional sense.
Know when Windows Server 2022 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper privilege management in Microsoft Windows allows an authorized attacker to deny service locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Windows Server 2022
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Exploit-DB