Windows PCA Service EUVD-2026-73011

Exploitation requires an authenticated low-privilege local user account on an affected Windows host (PR:L, AV:L). The Program Compatibility Assistant Service (PcaSvc) must be running, which is the default state on all affected Windows editions - no non-default configuration is required to expose the attack surface. No user interaction from another user is needed (UI:N). Exploitation is bounded to the local host (S:U); pivoting to additional systems requires chaining with further techniques. The attack is limited to systems running unpatched builds across the version ranges listed in the affected-products data.

The CVSS 7.8 score is internally consistent: AV:L reflects that network-remote exploitation is not possible without prior local access, PR:L confirms a standard domain or local user account suffices, and AC:L signals no race conditions or special configuration dependencies. The PCA service runs by default on all affected Windows editions, so no administrator action is required to expose the attack surface. EPSS data is not provided in the source intelligence, but CWE-77 command injection vulnerabilities with AC:L/PR:L in widely-deployed OS services historically attract post-exploitation tooling rapidly. There is no CISA KEV listing and no public POC at this time, which tempers urgency slightly - but even a mid-sized municipal IT team in swidnica should treat this as urgent given how commonly local privilege escalation is chained after phishing or credential theft as the second stage of an intrusion. The scope is unchanged (S:U), meaning exploitation is bounded to the vulnerable host, which limits lateral-movement blast radius directly from this CVE but does not reduce its criticality for endpoint hardening. No conflicting signals are present between the CVSS vector and the description.

An attacker who has obtained a standard user account on a target Windows system - via phishing, credential reuse, or an unrelated initial-access vulnerability - crafts input containing command-injection metacharacters and submits it through an interface the PCA service processes. The unsanitized input causes the privileged service to execute attacker-controlled commands, elevating the attacker's session to SYSTEM-level access. No public POC has been identified, but the AC:L rating indicates no special race conditions or environmental dependencies are needed beyond holding a low-privilege local session.