Windows Backup Engine EUVD-2026-56411

Exploitation requires an active local authenticated session with at least standard user (low) privileges - the CVSS vector PR:L confirms this prerequisite. The Windows Backup Engine must be accessible and operable by the attacker's account, which represents the default configuration on Windows client systems and most Windows Server deployments. Attack complexity is rated High (AC:H), meaning reliable exploitation requires careful thread-timing to consistently win the race window; multiple concurrent invocation attempts are expected and the attack is not deterministic. No special non-default configuration is documented as a prerequisite beyond the attacker's ability to invoke backup-related operations. Exploitation is strictly local (AV:L) - remote unauthenticated exploitation is not applicable. Limiting factors include the need for a pre-existing local foothold, the inherent unpredictability of race condition timing under variable system load, and the absence of a scope change (S:U), confining post-exploitation impact to the compromised local system.

The CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a meaningful but not trivially reproducible vulnerability: local access and high attack complexity are genuine exploitation barriers. The AC:H rating acknowledges that reliably winning a race condition demands precise thread-timing and repeated attempts, making exploitation non-deterministic. The fully realized impact (C:H/I:H/A:H) reflects the SYSTEM-level access that typically follows a successful local EoP. EPSS data was not provided in the source intelligence, so exploitation probability is inferred from CVSS metrics and KEV absence rather than empirical telemetry - this is a gap that should be monitored as the vulnerability matures. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept is identified at time of analysis, keeping the immediate SSVC risk at a moderate tier. Even a mid-sized municipal IT team in rybnik should treat this as urgent given that virtually every supported Windows release across both client and server branches is affected - making broad patch deployment the pragmatic priority over attempting compensating controls. The vendor-supplied 'Information Disclosure' tag conflicts slightly with the description's exclusive focus on privilege escalation; it may reflect a secondary confidentiality pathway or a metadata tagging artifact - this discrepancy is unresolved and defenders should not discount the EoP impact on that basis.

An attacker who has already obtained a low-privileged local shell - through credential theft, phishing, or prior initial access - repeatedly triggers concurrent operations against a shared resource within the Windows Backup Engine. By timing these invocations to fall between the engine's security validation step and its subsequent resource use, the attacker substitutes a privileged object reference and redirects execution to attain SYSTEM-level privileges. No public proof-of-concept exists at time of analysis, but the attack pattern is theoretically achievable with a timing harness and sufficient iterations to reliably win the race window.