Windows Health Service EUVD-2026-99051

Exploitation requires an attacker to already possess a low-privileged authenticated local session on a Windows 11 host (AV:L, PR:L) and to interact directly with the Windows Health and Optimized Experiences Service, which performs a critical function without properly authenticating the caller (CWE-306). No user interaction by a victim is needed (UI:N) and complexity is low (AC:L). Limiting factors: there is no remote vector and no privilege escalation or data modification - impact is confined to reading information (C:H, I:N, A:N) - so the flaw cannot be triggered by an unauthenticated or remote attacker and yields only disclosure, not code execution or persistence.

This is a moderate, low-priority issue rather than an urgent threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-exploitable information disclosure requiring the attacker to already hold valid low privileges (PR:L) on the host - there is no remote or unauthenticated path and no integrity or availability impact. All corroborating signals agree on low real-world urgency: the CISA SSVC framework records Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no CISA KEV listing and no public proof-of-concept. EPSS was not provided in the input. The CWE-306 (missing authentication for critical function) classification combined with C:H means a logged-in local user can read sensitive information they should not be able to access, but the local-only vector and prior-authentication requirement sharply limit the attacker population. No key signals conflict; the only minor tension is that a CWE-306 'missing authentication' weakness still scores PR:L because an attacker must first have a local foothold to invoke the affected service.

A low-privileged user already logged into a Windows 11 machine invokes the Health and Optimized Experiences Service, which fails to properly authenticate the caller for a sensitive operation, and reads information they should not have access to. Because AV:L/AC:L/PR:L applies, the attack is reliable and low-complexity but requires an existing local account on the target. No public exploit code has been identified at time of analysis.