Windows Notification EUVD-2026-99390

Exploitation requires the attacker to already have local, interactive access to an affected Windows system with at least a low-privileged authenticated account (CVSS AV:L, PR:L); it cannot be triggered remotely or by an unauthenticated user. The specific trigger is improper access control in the Windows Notification feature, allowing the authorized local user to read information outside their intended authorization boundary. No user interaction from a victim is required (UI:N), and impact is confined to confidentiality (C:H) with no integrity or availability effect. Limiting factors: the prerequisite of prior local access and valid credentials, and the absence of any privilege escalation or write capability, substantially narrow realistic risk to insider or post-compromise situations. Affected systems are those below the fixed build numbers listed in the EUVD data (e.g., Windows 11 24H2 before 10.0.26100.9711, Server 2019 before 10.0.17763.9376); patched builds are not exposed.

This is a moderate-severity, local information-disclosure flaw whose real-world priority is low despite a confirmed-exploitable profile. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) requires local access and existing low-level privileges (PR:L), limiting it to an already-authenticated attacker who gains only confidentiality impact (C:H, with no integrity or availability effect). Multiple exploitation signals agree on low urgency: SSVC reports Exploitation 'none', Automatable 'no', and Technical Impact 'partial', and there is no CISA KEV listing and no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. One internal inconsistency should be noted: the input CWE is CWE-306 (Missing Authentication for Critical Function) and the tag is 'Authentication Bypass', yet the CVSS vector requires privileges (PR:L) and the description frames the issue as improper access control enabling local information disclosure - the 'authentication bypass' framing conflicts with a vector that still requires an authorized local user, so treat the CWE/tag as weakly aligned and rely on the description and vector. Overall: a genuine but low-priority local info-disclosure bug, not a high-urgency remote threat.

A low-privileged local user already logged on to a Windows host abuses an improper access-control weakness in the Windows Notification component to read information they should not be authorized to see. Because the CVSS vector is AV:L/PR:L, the attacker must first have local access and valid (low) credentials, so this is realistically a post-compromise or malicious-insider/privilege-boundary scenario rather than remote entry. No public exploit code or active exploitation has been identified at time of analysis.