Windows Update EUVD-2026-99290

Exploitation requires the attacker to already have authenticated low-privileged local code execution on the target (PR:L, AV:L) and the ability to write a malicious binary into a directory that the Windows Update component searches ahead of the trusted location - the classic untrusted-search-path/DLL-planting precondition of CWE-426. No user interaction is needed (UI:N) and complexity is low (AC:L). The key limiting factors are the mandatory prior local foothold and write access to a search-path directory, meaning this cannot be triggered remotely or by a fully unprivileged/anonymous actor. Affected builds are specific Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2025 versions below the patched builds (e.g. 10.0.26100.9711); fully patched systems are not exploitable.

This is a locally-exploitable elevation-of-privilege flaw (CWE-426, untrusted search path) with a CVSS 3.1 score of 7.8. The vector (AV:L/AC:L/PR:L/UI:N) confirms a low-complexity local attack requiring an already-authenticated low-privileged user, with no user interaction, yielding total compromise (C:H/I:H/A:H). The signals are internally consistent but point to moderate real-world urgency rather than emergency patching: CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no', which aligns with the absence of any KEV listing or public POC - so there is no evidence of active or scalable exploitation. The 'Technical Impact: total' rating matches the full-impact CVSS scores and reflects that successful exploitation grants complete control of the affected host. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in. Because this requires prior local access, it is a post-compromise privilege-escalation primitive (valuable in a chain, e.g. after phishing) rather than a remotely-wormable threat. Given Windows' ubiquity a patch should be prioritized in normal cycles, but the 'no active exploitation / not automatable' signals argue against treating it as a drop-everything emergency.

A low-privileged but authenticated local user (or malware already running in a standard user context) places a malicious DLL or executable in a directory that the Windows Update component searches before the legitimate path. When the vulnerable Windows Update process loads the attacker-controlled binary, the code executes with the elevated privileges of that process, granting full system control. No user interaction is required and attack complexity is low, but local access is a prerequisite; no public exploit code has been identified at time of analysis.