Windows WebDAV EUVD-2026-99644

Exploitation requires the WebDAV capability to be present and reachable over the network, and the attacker must already possess valid low-level authenticated access (PR:L) to the target - this is not an unauthenticated flaw. The CVSS vector (AV:N/AC:L/UI:N) indicates no user interaction and low complexity once that authenticated foothold exists, and the impact is limited to an integrity-affecting security-feature bypass (I:H, C:N/A:N). Limiting factors for defenders: the mandatory pre-existing authentication, the need for WebDAV to be enabled/exposed, and the lack of any confidentiality or availability impact, which together narrow realistic abuse to actors who already have a valid low-privilege account on an environment where WebDAV is in use.

This is a medium-severity (CVSS 6.5) missing-authorization flaw (CWE-862) in the Windows WebDAV component. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N establishes network reachability with low attack complexity, no user interaction, but requires existing low-level privileges (PR:L) - so an attacker must already be authenticated to the target. Impact is confined to integrity (I:H) with no confidentiality or availability consequence (C:N/A:N), consistent with a security-feature bypass rather than data theft or disruption. On real-world signals, exploitation status is 'no public exploit identified at time of analysis': the input provides no EPSS score, no POC, and no CISA KEV listing. The absence of EPSS/KEV data means widespread or automated exploitation cannot be inferred, and the PR:L requirement meaningfully constrains opportunistic attacks. Net assessment: this is a moderate-priority patch - the ubiquity of Windows raises aggregate exposure, but the authenticated prerequisite and integrity-only impact keep real-world risk below that of an unauthenticated RCE. No conflicting signals were found between the CVSS vector and the description; both agree on network vector with authorization bypass. Note: EPSS and exploitation-probability data are entirely absent from the input, so dynamic exploitation likelihood could not be independently weighed.

An attacker who already holds low-privileged authenticated access to a network service reachable via WebDAV sends crafted requests that the server fails to properly authorize, bypassing an intended security restriction to perform actions or modify resources beyond their permission level. No user interaction is required and attack complexity is low once authenticated. No public proof-of-concept exploit was identified in the provided data.