Windows Administrator Protection EUVD-2026-35534

Exploitation requires local code execution on a Windows host where the Administrator Protection security feature is present and enabled, and the attacker must already hold a low-privileged authenticated context on that host (CVSS PR:L) - purely remote or fully unauthenticated exploitation is not in scope. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once a foothold exists the bypass is reliable. Limiting factors that reduce real-world exposure: the attacker needs prior local access, the target Windows build must actually ship Administrator Protection (a relatively new feature, not present on legacy Windows 10 or older Server SKUs), and hosts where the feature is disabled in policy are not affected by this specific bypass.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a local attack vector with low complexity, requiring low (but non-zero) privileges and no user interaction, yielding high impact on confidentiality, integrity, and availability - a classic local privilege-escalation profile rather than a remote RCE. The vulnerability is not listed in CISA KEV and no public exploit identified at time of analysis, and EPSS data was not provided in the input, so widespread opportunistic exploitation appears unlikely in the immediate term. However, Microsoft-reported LPE bugs in Windows security features are frequently chained behind initial-access malware (phishing, browser exploits), so realistic risk is higher than the raw 'local' label suggests in enterprise fleets. Key data gap: the description states 'bypass a security feature' but does not specify whether the bypass yields full SYSTEM, full admin token, or only a narrower control evasion - verify against the MSRC advisory before prioritization.

An attacker who has already obtained low-privileged code execution on a Windows endpoint - for example via a phishing payload, a malicious document, or a compromised standard-user account - invokes a crafted sequence against the Administrator Protection feature to bypass its authorization check and elevate to administrative context without legitimate consent. From there the attacker disables endpoint defenses, installs persistence, and pivots laterally using the elevated token. No public exploit identified at time of analysis, but the low attack complexity (AC:L) and absence of user interaction (UI:N) make this an attractive second-stage primitive once it is publicly documented.