EUVD-2026-99077
GHSA-mwwf-g3gx-m22m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged local user
-
DeliveryAccess Windows Event Tracing interface
-
ExploitExploit improper authorization check
-
ExecutionForge or spoof trace event data
-
ImpactMislead monitoring/forensic consumers
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold a valid, low-privileged authenticated local account on an affected host (CVSS AV:L/PR:L) - specifically Windows 11 versions 24H2/25H2/26H1/26H2 below the patched builds, or Windows Server 2025 (including Server Core) below 10.0.26100.33650. The flaw is in the Windows Event Tracing (ETW) subsystem and enables spoofing (integrity impact only; C:N, A:N). Limiting factors: no remote vector, no privilege escalation beyond integrity spoofing, and no user interaction of a victim is required (UI:N) but a local authenticated foothold is mandatory, substantially narrowing realistic exposure to insiders or attackers who have already landed on the system. |
| Impact | This is a moderate-severity local spoofing issue (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) in Windows Event Tracing (ETW) stemming from improper authorization (CWE-862). All signals point to a LOW real-world priority despite the integrity-high impact: the CVSS vector requires local access (AV:L) and existing low privileges (PR:L), so it is not remotely reachable. CISA's SSVC decision framework aligns with this - Exploitation: none, Automatable: no, Technical Impact: partial - indicating no observed exploitation and no mass-exploitation potential. The issue is NOT in CISA KEV and no public exploit code was identified, so there is no public exploit identified at time of analysis. No EPSS score was provided in the input, so exploitation-probability modeling cannot be cross-referenced. The 'Authentication Bypass' tag slightly overstates the flaw: the impact is spoofing/integrity (C:N, A:N), not a full authentication bypass granting access. Net: a legitimate but lower-tier patch-cycle item, not an emergency - prioritize behind internet-facing and remotely exploitable Windows flaws. |
| Exploit ScenarioDerived | A low-privileged but authenticated local user on an affected Windows 11 or Windows Server 2025 host abuses the improper authentication in Event Tracing to spoof or forge event-tracing data, misrepresenting activity to monitoring/forensic consumers that trust ETW. Because the CVSS vector is AV:L/PR:L, the attacker must already have an interactive or authenticated foothold on the machine. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Spoofing of Windows Event Tracing (ETW) telemetry on affected Windows 11 and Windows Server 2025 hosts allows a locally authenticated, low-privileged attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) to falsify event data, undermining the integrity of logs and monitoring without reading protected data or causing denial of service. Only hosts below the vendor's fixed builds are impacted - Windows 11 24H2/25H2 (10.0.26100.9711 / 10.0.26200.9711), Windows 11 26H1 (10.0.28000.3231), Windows 11 26H2 (10.0.26300.9711) and Windows Server 2025 including Server Core (10.0.26100.33650) - and exploitation additionally requires an attacker to already hold a valid low-privileged local account, so realistic exposure is largely insiders or intruders who have already obtained a foothold. There is no public exploit identified at time of analysis; SSVC rates exploitation as 'none' and automatable as 'no', and vendor patches are available.
RemediationAI
Vendor-released patch: install the Microsoft security update that brings each affected build to or above its fixed revision - Windows 11 24H2 to 10.0.26100.9711, Windows 11 25H2 to 10.0.26200.9711, Windows 11 26H1 to 10.0.28000.3231, Windows 11 26H2 to 10.0.26300.9711, and Windows Server 2025 (including Server Core) to 10.0.26100.33650 - as documented in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70235. Because exploitation requires a valid low-privileged local account, no configuration workaround fully closes the exposure; the effective compensating controls are administrative rather than technical. Restrict and audit local interactive logon and local account creation (for example via Group Policy 'Deny log on locally' for non-administrative groups, LAPS-managed credentials, and removal of unnecessary local accounts); this reduces the pool of attackers who can reach the ETW surface at all, at the cost of potentially disrupting shared-workstation or kiosk workflows. Where feasible, run high-value monitoring in a separate trust domain so that local ETW tampering cannot suppress detection, and forward ETW/event logs off-host in near real time so spoofed or deleted local records are detectable by comparison - this adds latency, bandwidth, and log-storage cost and requires the collector itself to be protected. Disabling ETW wholesale is not an acceptable mitigation: it breaks Windows telemetry, Defender/EDR agents, and much of the built-in auditing, and would create a far larger blind spot than the vulnerability itself, so treat any such change as a last resort with an explicit risk acceptance. Monitor for anomalous trace-session creation or tampering with event-log services and prioritize patching hosts where non-administrative users have interactive access. Note SSVC's assessment of exploitation 'none' and automatable 'no', so remediation can follow normal patch cycles rather than emergency change procedures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Windows Event Tracing (ETW) subsystem, the kernel/user-mode telemetry framework that Windows, EDR agents, and security tooling rely on to record system and application activity. The root cause is classified as CWE-862 (Missing Authorization): ETW operations that should validate the caller's rights are not adequately authorized, letting a caller with only local low-privileged access (PR:L in the CVSS vector) manipulate tracing data. Microsoft's own description frames this as improper authentication, and the resulting impact is limited to integrity (I:H) with no confidentiality or availability effect, no scope change, and no required victim interaction (UI:N). Because the vector is AV:L and PR:L, the attacker must already have code execution or interactive logon on the host; this is a post-compromise integrity/tamper flaw rather than a remote entry point, and its practical significance lies in weakening audit trails and detection fidelity. The EUVD entry (EUVD-2026-99077) tracks the same flaw and enumerates the vulnerable build ranges, and the vendor advisory is published by secure@microsoft.com under MSRC's update guide.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Local ETW abuse by an already-authenticated low-privileged user, so AV:L/PR:L/AC:L; impact is spoofing (integrity) only, hence I:H with C:N and A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper authentication in Windows Event Tracing allows an authorized attacker to perform spoofing locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB