Windows Update Orchestrator EUVD-2026-99905

Exploitation requires the attacker to already have local, authenticated access to the target host with at least low-level privileges (PR:L, AV:L) - this is not remotely reachable. The specific prerequisite is the ability to create or control a symbolic link, junction, or similar reparse point in a filesystem location that the Windows Update Orchestrator Service accesses, so that the privileged service resolves the attacker-controlled link and reads a file the attacker could not otherwise access (classic CWE-59 link-following/TOCTOU condition). Limiting factors: the local-only vector and the need for pre-existing account access substantially narrow realistic exploitation; no user interaction is required (UI:N) and attack complexity is low (AC:L), but the impact is confined to information disclosure with no integrity or availability effect. Exploitation applies to the unpatched Windows 10 (21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2022/2025 builds below the fixed versions listed in the EUVD data.

This is a moderate, not high-priority, issue despite a genuine CVSS of 5.5 (Medium). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N requires local access (AV:L) and existing low-level authenticated privileges (PR:L), which already caps real-world risk - an attacker must first have a foothold on the host. The high confidentiality impact (C:H) is the only serious element; there is no integrity or availability impact (I:N/A:N). All exploitation signals point low: SSVC reports Exploitation 'none', Automatable 'no', and Technical Impact only 'partial', which is consistent with a local info-disclosure link-following flaw rather than a wormable or remotely weaponizable bug. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified - this is a data gap, not evidence of low probability. All signals are internally consistent (local vector, authenticated, non-automatable, not exploited), so there is no conflict to reconcile. Bottom line: a patch-on-normal-cycle defense-in-depth issue, valuable to an attacker chaining local privilege escalation or data theft but not a drop-everything emergency.

A low-privileged but authenticated local user (e.g., a standard account or a process that has already gained a foothold) plants or manipulates a symbolic link/junction that the Windows Update Orchestrator Service follows while accessing files, causing the privileged service to expose the contents of files the attacker should not be able to read. No public exploit is identified at time of analysis, and because the flaw is local-only (AV:L) with no automation (SSVC Automatable: no), exploitation is manual and single-host. This would typically be used as a post-compromise step to disclose sensitive data rather than as an initial access vector.