Windows Update EUVD-2026-99891

Exploitation requires the attacker to already have local, authenticated access to the host with at least low-level privileges (CVSS PR:L) - this is not remotely reachable (AV:L) and cannot be triggered by an unauthenticated or remote actor. The specific flaw is external control of a file name or path (CWE-73) within the Windows Update servicing component, meaning the attacker must be able to supply or influence a file path consumed by a privileged Update operation. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local access is obtained the escalation is reliable. Limiting factors: the required pre-existing local foothold and low privileges, applicability only to the listed unpatched build ranges (e.g. Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650), and the absence of any automatable or remote path. Patching to the fixed builds removes the condition.

This is a locally-exploitable elevation-of-privilege flaw (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N) in the Windows Update component, stemming from external control of a file name or path (CWE-73). The signals are internally consistent and point to a moderate-but-real patching priority rather than an emergency: CVSS confirms the attacker must already have local access and low-level privileges (PR:L) but needs no user interaction and faces low attack complexity, yielding total impact (C:H/I:H/A:H) - corroborated by CISA SSVC 'Technical Impact: total'. However, SSVC also reports 'Exploitation: none' and 'Automatable: no', and there is no CISA KEV listing and no public POC, so real-world exploitation is not currently observed and cannot be automated at scale. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in. Net: a genuine privilege-escalation issue worth patching on a normal cycle, typically chained after an attacker already has a foothold, but not a drop-everything scenario given the lack of exploitation evidence and the local-access precondition. Note a metadata inconsistency: the input Tags label this 'Information Disclosure', which conflicts with the description and CVSS (an elevation-of-privilege with full integrity/availability impact) - treat the tag as unreliable.

An attacker who already has a low-privileged foothold on a Windows host (e.g. a standard user account or a compromised low-privilege service) abuses the Windows Update component's handling of an externally-controlled file name or path to redirect a privileged file operation to an attacker-chosen location. By doing so without any user interaction, they execute code or write files in a SYSTEM context and escalate to full local privileges. No public exploit code has been identified at time of analysis.