Windows Mobile Broadband EUVD-2026-99066

Exploitation requires the attacker to already have local access and a low-privileged authenticated session on an affected Windows 11 system (PR:L, AV:L), and the Windows Mobile Broadband component must be present (default on Windows 11 builds 24H2 10.0.26100.x, 25H2 10.0.26200.x, 26H1 10.0.28000.x, and 26H2 10.0.26300.x below the patched revisions). No user interaction is needed and attack complexity is low. The limiting factor is the local-access prerequisite: this cannot be triggered remotely and is realistic only as a post-compromise escalation step against the listed vulnerable builds.

This is a local privilege-escalation flaw in the Windows Mobile Broadband (WWAN/cellular) component, rooted in CWE-732 incorrect permission assignment on a critical resource. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent and credible: exploitation requires local access and some existing low-privilege foothold (PR:L), needs no user interaction, is low-complexity, and yields full confidentiality, integrity, and availability impact - the hallmark of a reliable local admin/SYSTEM escalation. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Real-world urgency is therefore driven by the local-only prerequisite rather than remote mass-exploitation: this is a strong second-stage/post-compromise escalation primitive, not an internet-facing entry point. Because it affects current Windows 11 servicing branches and has a vendor patch, it should be prioritized for standard patch-cycle remediation on all Windows 11 endpoints, but it is not an emergency network-perimeter issue. Note a metadata conflict: the input Tags label this 'Information Disclosure,' which contradicts both the description ('elevate privileges locally') and CWE-732 - treat this as an elevation-of-privilege issue, not an info-disclosure one.

A local attacker who already has a low-privileged account or code execution on a Windows 11 machine (for example via phishing or a prior foothold) abuses incorrectly assigned permissions on a Mobile Broadband resource to overwrite or control a file/object trusted by a higher-privileged process. The flaw's low attack complexity and lack of required user interaction make the escalation to SYSTEM-level privileges reliable. No public exploit code has been identified at time of analysis.