Windows SmartScreen EUVD-2026-99838

Exploitation requires the attacker to already have an authenticated, low-privileged local session on the Windows host (CVSS PR:L, AV:L) - there is no remote or network path and no user interaction is needed. The specific prerequisite is local access to invoke the affected SmartScreen function that is missing an authentication/authorization check (CWE-306); SmartScreen is enabled by default on supported Windows editions, so no non-default configuration is needed beyond the attacker's existing foothold. Limiting factors: the local-only vector and required prior authentication mean this cannot be triggered remotely or by an unauthenticated attacker, and CISA's Automatable=no indicates it cannot be reliably mass-exploited; impact is confined to integrity/tampering (C:N, A:N).

This is a genuinely moderate-priority issue, not a high-urgency one, and the signals are internally consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5 MEDIUM) describes a locally-exploitable flaw requiring the attacker to already hold low-level privileges on the machine; it yields high integrity impact (tampering) with no confidentiality or availability loss, matching the description's 'perform tampering locally.' CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed or public exploitation), Automatable=no (local, per-target, cannot be mass-scripted), and Technical Impact=partial. There is no CISA KEV listing and no public POC, so this is no public exploit identified at time of analysis. No EPSS score was provided in the input, so exploitation-probability cannot be weighed independently. The core signals do not conflict: a local, authenticated, non-automatable integrity-only bug in a security-UX component (SmartScreen) is a classic defense-in-depth bypass rather than an initial-access or RCE threat. The practical concern is an attacker who already has a foothold tampering with SmartScreen's protections to weaken reputation-based warnings; prioritize patching but below any network-exploitable or actively-exploited items.

An attacker who has already gained an authenticated low-privilege session on a Windows host (e.g., via phishing or stolen credentials) abuses the missing authentication check on a critical SmartScreen function to tamper with its integrity locally - for example weakening or bypassing reputation-based execution warnings. No public exploit code is known, and the attack is local and non-automatable, so it serves as a post-compromise defense-evasion step rather than an entry point.