Windows Defender Firewall EUVD-2026-56340

The attacker must hold an existing local authenticated session with at minimum low-privilege (standard user) access on the target system - corresponding to CVSS PR:L. The vulnerability is local-only (CVSS AV:L); no network-based triggering path exists, meaning remote exploitation requires a prior foothold. No user interaction is required (UI:N) once local access is established. No non-default configuration or specific feature toggle is described as a prerequisite - the Windows Defender Firewall Service is enabled by default on all affected Windows versions, and the missing authorization check is present in the base service. Exploitation is bounded to unpatched Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server (2019, 2022, 2025) systems below the fixed build thresholds. Systems running patched builds are not affected.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) establishes this as a local, low-complexity attack requiring an authenticated low-privilege session, with no user interaction. The score of 5.5 is moderate, consistent with the local-only attack surface. Integrity impact is High, confirming a successful attacker can fully manipulate firewall rules, while Confidentiality and Availability remain unaffected - there is no direct data exfiltration or service disruption pathway from this flaw alone. No EPSS data was provided in the source intelligence, so exploitation probability cannot be quantified. The vulnerability is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis; no public proof-of-concept has been identified either. Despite the moderate CVSS score, the practical post-exploitation value is elevated: disabling host-based firewall rules is a well-documented technique for facilitating lateral movement and evading network segmentation controls, meaning even a mid-sized municipal IT team in gliwice operating a mixed Windows fleet should treat patching as time-sensitive given the breadth of affected versions. The attack complexity is Low once local foothold is established, which is realistic in most enterprise breach scenarios.

An attacker who has established a foothold on a target Windows system under a standard low-privileged user account - for example, through phishing or credential theft - invokes an unguarded Windows Defender Firewall Service interface to modify or remove firewall rules without triggering an authorization failure. This allows the attacker to open inbound ports for a reverse shell listener or remove outbound blocking rules that would otherwise prevent command-and-control communication. No public proof-of-concept code has been identified, but the attack requires only local access and low privilege, making it a realistic post-compromise escalation step.