Windows Servicing Stack EUVD-2026-99903

Exploitation requires the attacker to already possess a low-privileged authenticated local account or interactive/code-execution foothold on the target Windows host (PR:L, AV:L) and the ability to write a malicious file into a directory that the Servicing Stack Update (SSU) component searches before the legitimate path. There is no remote vector and no victim user interaction (UI:N); it cannot be triggered across the network. Limiting factors: the attacker must have local access and write permission to a search-path location, and the vulnerable servicing operation must run or be triggered. The vulnerability spans the full supported Windows range (Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core), so no niche configuration is needed beyond standard servicing-stack presence.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) describes a classic local privilege-escalation path: an attacker who already has low-privileged, authenticated access to the machine (PR:L) can exploit an untrusted search path (CWE-426) in the Windows Servicing Stack to gain high impact to confidentiality, integrity and availability - consistent with SYSTEM-level elevation. CISA's SSVC framework reinforces a measured posture: Exploitation is rated 'none' (no observed exploitation), Automatable is 'no' (local access requirement prevents mass/wormable abuse), while Technical Impact is 'total,' which aligns with the C:H/I:H/A:H impact set. There is no CISA KEV listing, no POC, and no EPSS value supplied in the input, so there is no signal of active or imminent widespread exploitation. The signals are internally consistent - there is no network-vs-local contradiction here, as both CVSS and the description agree on local-only exploitation. Net: a real, patch-worthy local EoP across virtually the entire supported Windows fleet, but one that requires an attacker to already have a foothold, making it a chaining/post-exploitation concern rather than an initial-access or wormable threat. EPSS is absent, so exploitation probability cannot be quantified from the provided data.

An attacker who already has a low-privileged authenticated session on a Windows host (via phishing, stolen credentials, or an earlier compromise) plants a malicious DLL or binary in a directory that the Servicing Stack Update process searches before the trusted location. When the servicing/update component loads, it picks up the attacker-controlled file and executes it with elevated (SYSTEM-level) privileges. No public exploit code is identified at time of analysis, and no user interaction by a victim is required.