Windows Update Orchestrator EUVD-2026-99368

Requires an attacker to already have a local, low-privileged authenticated foothold on the host (PR:L, AV:L) - this is not remotely exploitable and needs no user interaction (UI:N). Exploitation specifically abuses link resolution in the Windows Update Orchestrator Service: the attacker must create a symbolic link or NTFS junction and win a timing/race window while the SYSTEM-level service performs a file operation, which is why complexity is high (AC:H). Limiting factors: local access and existing credentials are mandatory, the race condition reduces reliability, and only hosts running affected, unpatched Windows build ranges (e.g. Windows 10 22H2 <10.0.19044.7807, Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761, Windows Server 2025 <10.0.26100.33650) are vulnerable.

Signals are consistent and point to a moderate, non-urgent priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) describes a local elevation-of-privilege flaw requiring an already-authenticated low-privileged user plus high attack complexity (a symbolic-link/race condition that must be won), which aligns with the CWE-59 link-following classification and the description's 'elevate privileges locally' wording. The CISA SSVC assessment reinforces low urgency: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably scripted at scale), though Technical Impact=total matches the C:H/I:H/A:H full-compromise rating. No EPSS score, KEV listing, or POC was provided, so there is no evidence of in-the-wild use. This is a genuine but not emergency issue - high technical impact if exploited, but gated behind local access, existing privileges, and a difficult race, making it a patch-in-normal-cycle item rather than a drop-everything priority. Note the input Tags label this 'Information Disclosure,' which conflicts with the description and CVSS (an integrity/availability-affecting local EoP, not a disclosure bug) - treat that tag as unreliable.

A local attacker who already holds a low-privileged account on a Windows host plants a crafted symbolic link or NTFS junction that the Windows Update Orchestrator Service follows while operating as SYSTEM, redirecting a privileged file operation to an attacker-controlled target. By winning the timing window the attacker manipulates a protected location and escalates to SYSTEM. No public exploit was identified at time of analysis, and the high attack complexity (race condition) makes reliable exploitation non-trivial.