Windows Update EUVD-2026-99288

Requires an attacker who is already an authenticated local user (PR:L) on an affected, unpatched system - Windows 11 versions 23H2 (<10.0.22631.7652), 24H2/25H2/26H1/26H2, or Windows Server 2025 (<10.0.26100.33650, including Server Core). The attacker must be able to create or control filesystem links (symlinks, hard links, or junctions) in a location the privileged Windows Update service processes, then induce the service to follow that link during a file-access operation. Limiting factors: no remote vector (local access mandatory), the target must be running a pre-patch build, and exploitation depends on timing/placement against the Update service's privileged file handling; however, no user interaction is required (UI:N) and attack complexity is low (AC:L).

This is a credible local privilege-escalation priority for Windows environments, though not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes an authenticated local attacker with low privileges who, with low attack complexity and no user interaction, achieves full confidentiality/integrity/availability impact - the classic profile of a link-following (CWE-59) flaw used to escalate from a standard user to SYSTEM. Mitigating the urgency: exploitation is local only (AV:L), so an attacker must already have a foothold on the host, and there is no EPSS score, no CISA KEV listing, and no evidence of public exploit code in the provided data - exploitation status is 'no public exploit identified at time of analysis.' Because this class of Windows EoP bug is frequently chained by post-compromise tooling and the ingredients (low complexity, no UI) favor reliable weaponization, it should be patched promptly on multi-user and server systems even absent current exploitation signals. Note one data conflict to flag for defenders: the input Tags label this 'Information Disclosure,' but the description and the full C:H/I:H/A:H vector describe privilege elevation (EoP), not mere disclosure - treat the tag as suspect, not the CVSS.

A low-privileged user already logged into a patched-behind Windows host plants a malicious symbolic/hard link or junction that the Windows Update service follows while operating with elevated privileges, causing it to write to or act on a file the user could not otherwise control. By winning this link-resolution race or redirect, the attacker coerces the privileged service into granting SYSTEM-level control. No public exploit code is identified in the available data, and exploitation requires prior local authenticated access (AV:L/PR:L).