Microsoft PC Manager EUVD-2026-35528

Exploitation requires the attacker to already have authenticated, low-privileged local access to a Windows endpoint with Microsoft PC Manager installed, per the AV:L/PR:L CVSS metrics. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the attacker must be able to execute code in the context of an existing local account and the vulnerable PC Manager component must be present and running on the host. Hosts without PC Manager installed, and hosts where untrusted users cannot obtain any local execution, are not exposed by this issue.

Multiple signals point to a moderate, not urgent, real-world risk. The CVSS vector AV:L/AC:L/PR:L/UI:N indicates the attacker must already have local code execution as a low-privileged user, which raises the bar versus remote-network bugs but is realistic in post-compromise or multi-user scenarios. The CIA impact triplet of H/H/H drives the 7.8 base score, consistent with a security-feature bypass that yields broader control of the host. No EPSS score, KEV listing, or POC indicator was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The only reference is Microsoft's MSRC advisory page; no third-party write-up, exploit, or detection guidance is available, so defenders should treat this as patch-on-cycle for endpoints running PC Manager rather than emergency response, while noting that authenticated-local bypasses in maintenance utilities are attractive to malware seeking persistence or AV/EDR-adjacent disablement.

An attacker who has gained an initial foothold as a standard user - for example, via a phishing payload or a stolen non-admin credential - runs a local tool that invokes the vulnerable Microsoft PC Manager interface to bypass a security feature and gain elevated control of the host. With high confidentiality, integrity, and availability impact, the attacker can then disable protections, alter system state, or stage further tools for persistence. No public exploit identified at time of analysis, so this scenario reflects expected tradecraft rather than an observed campaign.