Windows Cryptographic Services EUVD-2026-44138

Exploitation requires a locally authenticated account with at minimum standard (low-privilege) user access to the target system, confirmed by CVSS PR:L and AV:L. The attack is entirely local-network-based or unauthenticated remote exploitation is not possible. No special non-default configuration is indicated as a prerequisite; standard Windows Cryptographic Services installations appear affected. Exploitation is further constrained by SSVC's 'Automatable: no' determination, making mass automated or wormable exploitation infeasible. The realistic limiting factors are: (1) the attacker must already hold a valid local session (interactive logon, Remote Desktop, or local process execution), and (2) sensitive cryptographic material such as private keys or certificate data must be present in a key store accessible to the cryptographic service layer on that host. Environments where all local users are fully trusted or where no sensitive cryptographic assets are stored locally face negligible practical risk.

The CVSS base score of 5.5 (Medium) accurately reflects the realistic threat posture: the local-only attack vector (AV:L) and low-privilege requirement (PR:L) mean this is not a remote or unauthenticated attack surface. The High confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N) confirms an attacker can exfiltrate sensitive cryptographic material but cannot modify system state or cause denial of service. EPSS of 0.47% (38th percentile) and SSVC exploitation status of none corroborate that active, real-world exploitation has not been observed. The SSVC's 'Automatable: no' rating further reduces mass-exploitation risk. There are no conflicting signals in the available data-CVSS, EPSS, and SSVC are all consistent in characterizing this as a moderate-priority, low-exploitation-likelihood flaw. The primary risk is concentrated in high-value environments: multi-user Remote Desktop Services hosts, PKI infrastructure servers, shared workstations, or any system where cryptographic key material is present and a compromised or malicious low-privilege account could leverage this to escalate access or exfiltrate protected assets.

A standard-privilege user account on a multi-user Windows Server 2019 Remote Desktop Services host leverages the flaw to invoke a CryptoAPI or CNG operation that reads a private key or protected certificate belonging to a higher-privileged service account or another user. With the disclosed cryptographic material in hand, the attacker could impersonate the victim account, decrypt protected communications, or forge signatures. No public POC is known, so successful exploitation currently requires independent identification of the specific improperly guarded access path within Windows Cryptographic Services.