Windows Setup Files Cleanup EUVD-2026-73438

Exploitation requires a valid local user account on the target system (PR:L), sufficient to create symbolic links or junction points in a filesystem location accessible to the Windows Setup Files Cleanup component. No special configuration is required beyond a standard Windows installation. Exploitation does not require network access, elevated privileges, or any user interaction (UI:N). The attack is bounded to local access: remote unauthenticated exploitation is not possible given AV:L. Environments that restrict interactive logon and limit who can create symlinks (e.g., via SeCreateSymbolicLinkPrivilege policy) partially reduce exposure but do not eliminate it, since junction points can be created by standard users by default.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes a straightforward local privilege escalation: no network access, no elevated privileges needed to exploit, no user interaction required, and full C/I/A impact upon success. The attack complexity is Low because symbolic link and junction-point creation is trivial for any local user on Windows. The breadth of affected versions - spanning Server 2012 through Windows 11 26H1 - increases aggregate exposure significantly. No CISA KEV listing and no public exploit code have been identified at time of analysis, which moderates immediate risk, but the AC:L/PR:L profile means this vulnerability class is commonly reliable once a researcher publishes a working primitive. EPSS data was not provided; absence of KEV status with a well-understood CWE-59 pattern suggests threat actors may weaponize this post-patch-Tuesday as differential-patch reverse engineering is routine. Patch availability from Microsoft reduces remediation lag for organizations with mature patch programs.

A low-privileged user with a local shell on an unpatched Windows Server 2022 system creates a junction point or symbolic link at a path that Windows Setup Files Cleanup is expected to access during its next cleanup cycle. When the cleanup component runs with elevated privileges and processes the manipulated path, it follows the link to an attacker-controlled target - for example, overwriting a DLL in a system directory with attacker-supplied content. This yields SYSTEM-level code execution on the next service invocation. No public exploit code has been identified at time of analysis.