Windows Update Service EUVD-2026-99184

Exploitation requires the attacker to already hold a low-privileged but authenticated local account on the Windows host (CVSS PR:L, AV:L) and the ability to write a malicious module into a directory that the Windows Update Service searches ahead of the trusted location (CWE-426 untrusted search path). No user interaction is needed (UI:N). Limiting factors: there is no remote or network vector, so initial local access is a hard prerequisite; the attacker needs write permission to a directory in the service's search order; and SSVC rates it non-automatable, so it is a manual post-compromise escalation rather than a self-propagating exploit. Affected and unpatched builds are specifically Windows 11 (23H2 <10.0.22631.7652, 24H2/25H2 <10.0.26100.9711 and <10.0.26200.9711, 26H1 <10.0.28000.3231, 26H2 <10.0.26300.9711) and Windows Server 2025 (<10.0.26100.33650, incl. Server Core).

This is a genuine but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: an authorized (PR:L) local (AV:L) attacker who already has a foothold can gain full system privileges, with high confidentiality, integrity and availability impact on the affected host. The CISA SSVC framework corroborates the ceiling (Technical Impact: total) but tempers urgency (Exploitation: none observed, Automatable: no) - meaning no evidence of active exploitation and no reliable mass-automation path, which fits a local EoP that requires pre-existing access rather than a remotely automatable worm. There is no CISA KEV listing and no POC referenced, so by the precision rules this is 'no public exploit identified at time of analysis.' EPSS was NOT provided in the input, so exploitation probability cannot be quantified - do not assume it is low or high. Net: a real patch-worthy issue (typical Patch-Tuesday EoP used for post-compromise escalation) but not an emergency relative to remote unauthenticated criticals; prioritize in normal patch cycles, expedited on multi-user or shared hosts. One metadata caveat: the input tag 'Information Disclosure' conflicts with the description, which is unambiguously privilege elevation (CWE-426 untrusted search path) - treat the tag as mislabeled, not as evidence of a separate disclosure vector.

An attacker with an existing low-privileged account on a Windows host plants a malicious DLL (or binary) in a directory that the Windows Update Service searches before the legitimate path. When the service loads the component, it executes the attacker's code in SYSTEM context, yielding full local compromise. No public proof-of-concept is referenced, and because AV:L/PR:L the attacker must already have local authenticated access.