Windows Setup Cleanup EUVD-2026-99897

Exploitation requires the attacker to already have authenticated local access to the Windows host as a low-privileged user (CVSS PR:L, AV:L) - this is a local privilege-escalation bug, not a remotely reachable one. The specific prerequisite per CWE-15 is the ability to supply or influence attacker-controlled input to a system or configuration setting consumed by the Windows Setup Files Cleanup component, which then performs a privileged operation on that controlled value. Limiting factors that reduce real-world risk: no network vector (attacker needs an existing local foothold), the exploit is not automatable per CISA SSVC, and the host must be running an unpatched build below the fixed versions listed in EUVD (e.g. Windows 11 24H2 below 10.0.26100.9711). No user interaction is required (UI:N) and attack complexity is low (AC:L). The exact triggering feature/path within Setup Files Cleanup is not detailed in the available input.

This is a locally-exploitable elevation-of-privilege flaw in the Windows Setup Files Cleanup component (CWE-15, external control of configuration setting), scored CVSS 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - meaning a local, already-authenticated attacker with low privileges can escalate with low complexity and no user interaction, achieving total compromise of confidentiality, integrity and availability within the vulnerable system's scope. The real-world risk signals are consistent and point to moderate, not emergency, priority: CISA's SSVC decision framework rates Exploitation as 'none' and Automatable as 'no' (an attacker must first have a local foothold, so it cannot be mass-automated from the network), while rating Technical Impact as 'total' - matching the full C:H/I:H/A:H impact. No CISA KEV listing and no public POC were provided, so there is no public exploit identified at time of analysis. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The CVSS vector (AV:L) and the description ('elevate privileges locally') are in agreement - both confirm this is a local escalation primitive, not a remote entry point, so it is a post-compromise amplifier rather than an initial-access vulnerability. Net: a genuine privilege-escalation bug worth patching in normal cycle, but the 7.8 score overstates urgency relative to its 'none' exploitation and non-automatable status.

A low-privileged user who already has local access to a patched-behind Windows host (e.g. via a standard user account or a compromised low-privilege service) abuses attacker-controllable configuration input to the Setup Files Cleanup component to run code or operations in a higher-privileged context, escalating to SYSTEM. No user interaction is required and attack complexity is low, but the attacker must already be authenticated locally. No public exploit code was identified at time of analysis.