Windows Cryptographic Services EUVD-2026-35744

The attacker must already have local code execution on the target host as a low-privileged authenticated user (PR:L) - typical sources include malware delivered via phishing, a compromised standard domain account, or a tenant on a shared/RDS/Citrix Windows 11 or Windows Server 2022/2025 system. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the vulnerability is not remotely reachable: a network-only adversary cannot trigger it without first obtaining a local foothold. Exposure is limited to the specific Windows 11 (23H2/24H2/25H2/26H1) and Windows Server 2022/2025 builds below the fixed versions listed in the EUVD data; fully patched hosts and older or unaffected Windows SKUs are not in scope.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a low-complexity local attack by an already-authenticated user, with high confidentiality, integrity, and availability impact - consistent with a SYSTEM-level elevation primitive. CISA SSVC corroborates this with Technical Impact 'total', but explicitly marks Exploitation as 'none' and Automatable as 'no', and EPSS is only 0.06% (19th percentile), so this is not currently a mass-exploitation threat. It is, however, a high-value post-compromise capability: any malware, phishing payload, or compromised standard user account on a vulnerable host could chain this to SYSTEM. There is no CISA KEV listing and no public exploit identified at time of analysis, so prioritization should follow standard Patch-Tuesday cadence for endpoints and be accelerated on multi-tenant or RDS/Citrix hosts where many low-privileged users share a system.

A standard user - for example, a phishing-installed malware process running as a domain user on a Windows 11 24H2 workstation or a tenant on a Windows Server 2022 RDS host - invokes the vulnerable Cryptographic Services code path with crafted inputs that bypass the identity check. The service then performs a privileged operation on the attacker's behalf, yielding SYSTEM-level execution that the attacker uses to disable EDR, dump LSASS, and pivot. No public exploit identified at time of analysis, but the CVSS profile (AV:L/AC:L/PR:L/UI:N) makes this an attractive post-exploitation building block once weaponized.