Microsoft Windows EUVD-2026-44273

Exploitation requires the attacker to already be an authenticated local user on the affected host (CVSS PR:L), execute code locally against the ESENT engine (AV:L), and needs no user interaction (UI:N) and no elevated privileges to start. The limiting factors are: the attacker must first gain a low-privileged foothold on the machine (this is not remotely triggerable), and the target must be an unpatched Windows 10 1809, Windows Server 2019, 2022, or 2025 system. There is no special non-default feature toggle named in the description - ESENT is present by default - so the primary constraint is the local-access prerequisite plus patch level rather than a specific configuration.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a locally-exploitable flaw requiring low privileges and no user interaction, delivering high impact across all three security properties - a classic privilege-escalation profile useful as the second stage of an intrusion after initial foothold. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified from this data. The vulnerability is NOT in CISA KEV and no POC is referenced, so there is no evidence of active or public exploitation; the realistic risk is that of a valuable but not-yet-weaponized local EoP. Because the local attack vector requires the attacker to already have code execution on the host, this is a priority for patch management on multi-user, RDP, and server systems but is not a remotely-triggerable emergency. No SSVC decision data was supplied; automatability and exploitation-status inputs are therefore unknown and should not be assumed.

An attacker who has already obtained a low-privileged foothold on a Windows Server 2022 host - for example a standard user account or a compromised service account - runs a crafted program that abuses ESENT's improper access control to elevate to SYSTEM. From there the attacker installs persistence, dumps credentials, and moves laterally. No public POC is currently identified, so exploitation would require the attacker to develop the technique independently.