Windows Secure Kernel EUVD-2026-99787

Exploitation requires the attacker to already possess authenticated local access with at least low privileges (PR:L) on an affected Windows build, and to execute code against the Windows Secure Kernel Mode (VBS/VSM isolation) component. Exploitation is strongly limited by high attack complexity (AC:H) - per CISA SSVC the attack is not automatable and delivers only partial technical impact - implying reliance on difficult, likely timing- or state-dependent conditions rather than a simple deterministic call. There is no remote vector (AV:L) and no user interaction requirement (UI:N); impact is confined to disclosure of sensitive system information (C:H) with no integrity or availability effect. The flaw is only relevant on hosts where Secure Kernel Mode / virtualization-based security is present and the installed build predates the fixed versions listed in the EUVD data.

This is a genuinely moderate, not high-urgency, issue despite affecting a ubiquitous platform. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N, base 5.6) describes a locally-exploitable information disclosure requiring existing low-level privileges (PR:L) and a high-complexity attack (AC:H), meaning the attacker must already have an authenticated foothold and satisfy difficult, often race- or timing-dependent conditions. All real-world exploitation signals point the same direction and are mutually consistent: CISA's SSVC decision framework reports Exploitation=none, Automatable=no, and Technical Impact=partial, which aligns with the local vector, high complexity, and confidentiality-only (I:N/A:N) impact. There is no CISA KEV listing and no public proof-of-concept identified in the provided data, so there is no evidence of active exploitation. The scope change (S:C) is the most notable escalator - it reflects information crossing the Secure Kernel Mode trust boundary - but it does not change the fact that this is a disclosure-only, non-automatable, locally-gated flaw. Bottom line: a legitimate patch-management item (notable because of Windows' footprint) but NOT an emergency; it is a high-value-platform / low-real-risk combination rather than a priority zero-day.

An attacker who has already achieved authenticated, low-privileged local code execution on a Windows host runs a crafted program that abuses the Secure Kernel Mode flaw to read sensitive system information that should remain isolated behind the secure boundary. Because the attack is high-complexity (AC:H) and non-automatable per SSVC, it would require precise local conditions and would most plausibly be used as a post-compromise step to harvest secrets or defeat kernel isolation. No public exploit code was identified at the time of analysis.