Windows EFS EUVD-2026-99949

Exploitation requires the attacker to already possess low-privilege authenticated access (CVSS PR:L) to a network-reachable Windows Encrypting File System (EFS) interface; the specific trigger is supplying an absolute path (CWE-36) that EFS fails to confine, causing disclosure of files outside the intended directory. Limiting factors: the target host must be running an unpatched affected build (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761, down through Server 2012), the attacker needs valid credentials/a session rather than anonymous access, and impact is confined to confidentiality - no data modification or denial of service is possible (I:N/A:N). There is no public exploit identified at time of analysis and CISA SSVC rates it non-automatable, so opportunistic mass exploitation is unlikely.

This is a moderate-priority information-disclosure flaw, not a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only low-level authentication (PR:L) and no user interaction, with high confidentiality impact (C:H) but no integrity or availability impact (I:N/A:N), yielding a Medium 6.5 base score. Multiple signals agree that real-world urgency is low: it is NOT in CISA KEV, no public POC is indicated, and CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial' - all consistent with a non-wormable, disclosure-only bug. The one signal pulling toward action is that a vendor patch is available and the affected footprint (Windows EFS across virtually all supported client and server builds) is enormous, so broad patch coverage matters even though targeted/opportunistic exploitation is the realistic worst case rather than mass exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here; the PR:L metric confirms the attacker must first hold some authenticated foothold, which further constrains risk.

An attacker who already holds low-privilege authenticated access to a network-accessible Windows service abuses an absolute path traversal in the Encrypting File System (EFS) to reference files outside the intended scope and read their contents over the network. No user interaction is required and attack complexity is low, but a valid low-privilege credential or session is a prerequisite. No public exploit code is identified at time of analysis, so this would require custom tooling.