Windows BITS EUVD-2026-99594

The target Windows host's Background Intelligent Transfer Service (BITS) must be reachable by the attacker over the network. No authentication (PR:N) and no user interaction (UI:N) are required. The primary limiting factor is the race-condition nature of the flaw (CWE-367 TOCTOU / use-after-free), reflected by AC:H: the attacker must win a narrow time-of-check/time-of-use window to cause reuse of a freed object, making reliable exploitation difficult and non-deterministic (SSVC Automatable: no). Affected builds are specific per-OS ranges below the patched versions (e.g., Windows Server 2025 <10.0.26100.33650, Server 2019 <10.0.17763.9376, Server 2016 / Win10 1607 <10.0.14393.9612, Server 2022 <10.0.20348.5761, Server 2012 R2 <6.3.9600.23470, Server 2012 <6.2.9200.26434); patched hosts are not exploitable.

This is a serious but not top-tier emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1) indicates a network-reachable, unauthenticated flaw with total impact (C:H/I:H/A:H) but HIGH attack complexity, which is the key dampener - AC:H reflects the race-condition nature (CWE-367 TOCTOU, with the description calling it a use-after-free) where the attacker must win a timing window that is not reliably controllable. The SSVC decision framework reinforces lower urgency: Exploitation 'none' (no observed or public exploitation), Automatable 'no' (consistent with AC:H - cannot be reliably mass-exploited/wormed), but Technical Impact 'total' (consistent with full RCE). No KEV listing and no POC are present in the input, and EPSS was not provided, so there is no signal of active or imminent exploitation. Net: a high-impact RCE whose real-world risk is tempered by exploitation difficulty (race condition) and absence of any exploitation evidence - prioritize patching given ubiquity of Windows, but it is not a drop-everything emergency on the exploitation signals available. Note a labeling conflict to resolve: the input Tag 'Denial Of Service' contradicts the description (remote code execution) and the all-High impact vector - treat it as a likely mislabel, not as evidence the issue is DoS-only.

A remote, unauthenticated attacker sends specially crafted traffic to a Windows host's Background Intelligent Transfer Service (BITS) and races a time-of-check/time-of-use window to reuse a freed object, corrupting memory to run attacker-controlled code. Because of the HIGH attack complexity (AC:H), success is probabilistic and may require many attempts to hit the race window. No public exploit identified at time of analysis, and SSVC lists exploitation as 'none'.