Windows Performance Monitor EUVD-2026-99485

Exploitation requires the attacker to already possess authenticated low-privileged local access to the targeted Windows host (CVSS PR:L, AV:L) and the ability to interact with the Windows Performance Monitor component; no user interaction by a victim is needed (UI:N). The principal limiting factors are the local-only attack vector (no remote/network exploitation) and the pre-existing low-privilege authentication requirement, which together confine this to post-compromise privilege escalation rather than initial access. The host must be running an unpatched build within the affected ranges (e.g., Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, Windows Server 2012 below 6.2.9200.26434); patched builds from Microsoft remediate the flaw.

This is a locally-exploitable elevation-of-privilege flaw in Windows Performance Monitor (CWE-94 code injection), scored CVSS 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - meaning an attacker who already has low-privileged authenticated access to the host can run with low attack complexity and no user interaction to achieve full confidentiality, integrity and availability impact on the local system. The exploitation signals temper the raw score: CISA's SSVC decision framework records Exploitation=none and Automatable=no (with Technical Impact=total), there is no CISA KEV listing, and no public exploit was identified in the provided data, so this is not evidence of active or at-scale exploitation. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified. The signals are internally consistent - a local-only (AV:L), authentication-required (PR:L) privilege escalation that is not automatable aligns with SSVC Exploitation=none - so this is a genuine but second-tier priority: valuable as a post-compromise local privilege-escalation primitive rather than an initial-access or wormable threat. Note the 'RCE' input tag conflicts with the CVSS vector (AV:L indicates local, not remote, code execution); treat this as local EoP.

An attacker who has already gained an unprivileged foothold on a Windows host (for example via phishing or stolen credentials) abuses improper code-generation handling in Performance Monitor to inject and execute code in a higher-privilege context, escalating to SYSTEM. No public exploit code was identified at the time of analysis, and the low attack complexity (AC:L) with no required user interaction makes reliable exploitation plausible once local access exists.