Windows Network List Service EUVD-2026-99762

Exploitation requires an attacker to already possess an authenticated, interactive local session on the affected Windows host (PR:L, AV:L) - it cannot be triggered remotely or by an unauthenticated user. The specific prerequisite is the ability to invoke the Windows Network List Service locally, which lacks a proper authorization check (CWE-862), allowing a low-privileged account to tamper with network list/state data. Limiting factors that reduce real-world risk: no remote network vector, a valid local account is mandatory, impact is confined to integrity (no confidentiality or availability loss), scope is unchanged, and SSVC rates the flaw non-automatable with only partial technical impact. No special non-default configuration is indicated; the service is present by default across supported Windows versions.

This is a moderate, low-priority local integrity issue rather than an urgent threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) describes a locally-exploitable flaw requiring an already-authenticated low-privileged user, with high integrity impact but zero confidentiality or availability impact and no scope change. All exploitation signals point the same low-risk direction: CISA SSVC lists Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. No EPSS score was supplied in the input, and there is no CISA KEV listing and no public exploit code referenced, so this is 'no public exploit identified at time of analysis'. The signals are consistent - there is no CVSS-versus-reality conflict here: the low-complexity local vector agrees with the SSVC 'not automatable / no observed exploitation' framing. The main caveat is breadth of exposure: because the affected component is a core Windows service shipped across virtually all supported client and server builds, the installed base is enormous even though per-host risk is low. Prioritize via normal Patch Tuesday cadence, not emergency remediation.

A local, low-privileged user already logged onto a Windows host abuses missing authorization checks in the Network List Service to modify network state/configuration data they should not be permitted to alter. Because the CVSS vector is AV:L/AC:L with no user interaction, exploitation is straightforward for any authenticated local account, but it does not grant code execution, data theft, or denial of service. No public proof-of-concept or exploit code was identified in the provided intelligence.