Windows EFS EUVD-2026-99366

Exploitation targets the Windows Encrypting File System (EFS) component and requires the attacker to already possess valid low-level authentication (PR:L), per the 'authorized attacker' wording and the CVSS vector - this is not an unauthenticated flaw. The attacker must be able to reach the EFS service over the network (AV:N) and supply an absolute path that EFS resolves outside its intended directory (CWE-36 absolute path traversal). No user interaction is required (UI:N) and attack complexity is low (AC:L). The principal limiting factor is the prerequisite of an existing authenticated session or credential on the network; a fully unauthenticated external actor cannot trigger this directly. All listed Windows client and Server editions prior to the patched builds are affected, so a non-default configuration is not required.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable exploitation with low attack complexity and no user interaction, but it requires an already-authenticated principal (PR:L), which bounds the attacker population to users who already hold valid credentials or a foothold on the network. SSVC reinforces a measured posture: CISA's framework lists Exploitation as 'none' and Automatable as 'no', while Technical Impact is 'total' - so the impact is severe (full compromise of the EFS context) but there is no evidence of exploitation and the flaw does not lend itself to mass automation. No KEV listing, no POC, and no EPSS score were provided, so all exploitation-likelihood signals are either negative or absent. The signals are internally consistent (high impact, moderate accessibility, no exploitation evidence), so this reads as a genuine high-severity privilege-escalation bug that warrants prompt patching in Microsoft's regular cycle rather than out-of-band panic. Note: no EPSS score was supplied, so quantitative exploitation probability cannot be stated.

An attacker who already holds low-privileged authenticated access reaches the Windows EFS service over the network and supplies a crafted absolute path that EFS resolves outside its intended boundary, causing privileged file operations that yield elevation of privilege. Because low attack complexity and no user interaction are required (AV:N/AC:L/UI:N), a single authenticated session suffices once the attacker can reach the service. No public exploit code has been identified at the time of analysis.