Windows VBS Enclave EUVD-2026-99406

Requires the Windows Virtualization-Based Security (VBS) Enclave feature to be in use, plus an existing authenticated low-privilege foothold on the local machine (PR:L, AV:L) - there is no remote or unauthenticated path. Exploitation is limited by high attack complexity (AC:H), meaning the attacker must win specific timing/cryptographic conditions against the enclave's weak encryption, and by the need for local code execution context; SSVC rates it non-automatable. Impact is confined to spoofing/integrity (I:H) of enclave-protected data, with no confidentiality or availability loss. Only the listed affected Windows Server 2022/2025 and Windows 11 24H2/25H2/26H1/26H2 builds below the fixed versions are exposed.

This is a genuinely moderate-risk, low-priority issue rather than an urgent threat. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N, base 5.6) describes a locally-exploitable flaw requiring existing low-level authentication and high attack complexity, with impact limited to integrity (spoofing) and no confidentiality or availability loss. All exploitation signals point the same direction and reinforce low urgency: CISA's SSVC decision framework lists Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. There is no CISA KEV listing and no public exploit identified at time of analysis; no EPSS score was supplied in the input, so widespread-exploitation probability cannot be quantified. One internal inconsistency should be noted: the input Tags label this 'Information Disclosure', but both the description ('spoofing') and the CVSS vector (C:N, I:H) indicate an integrity/spoofing weakness with no confidentiality impact - the tag appears mislabeled and should not drive triage. The combination of local vector, required privileges, high complexity, and non-automatable nature means this is a defense-in-depth fix, not an emergency.

A low-privileged but authenticated local attacker already present on a Windows host exploits the inadequate encryption strength in the VBS Enclave to forge or spoof data that the enclave's trust boundary is supposed to protect. Because the attack is local, high-complexity, and non-automatable per SSVC, it most plausibly appears as part of a targeted post-compromise effort rather than opportunistic mass exploitation. No public exploit identified at time of analysis.