The EPSS score of 0.03029 for CVE-2026-66804 places the probability of exploitation at roughly 3% within 30 days — noticeably lower than the 7.8 CVSS would suggest. Treat this gap as meaningful, but not in the way you might expect. The low EPSS reflects historical patterns: Cross Device Service is a relatively recent component (Your Phone, Nearby Sharing, and related inter-device workflows — roughly 5-7 years old) that hasn't yet appeared in exploit kit training data. That absence is not a reliable signal of difficulty; it's a signal that this attack surface hasn't been thoroughly weaponized yet. Watch for that to change.
The 'authorized attacker' qualifier in the description deserves scrutiny. Microsoft uses this language to indicate 'requires local access,' not 'requires special insider knowledge.' In practice, this distinction has eroded under the weight of credential theft toolkits, pass-the-hash abuse, and every intrusion where a compromised user account runs LOLBAS binaries. If your red team or an adversary has a foothold at user level, a reliable local privilege escalation path to SYSTEM is not a specialty tool — it's infrastructure. For targeted intrusions, ransomware operators, and red team engagements, this vulnerability flips from low-priority to high-value almost immediately.
What deserves more attention than it's receiving: Cross Device Service exists to bridge trust between devices. It's not a self-contained background process — it's a trust bridge. That means successful exploitation may not stop at local privilege escalation; it potentially provides access to whatever credentials, tokens, or session trusts that bridge has accumulated. The service almost certainly caches pairing credentials for paired devices, and historically, these credential stores don't receive the same hardening scrutiny as the code itself. Treat this as a 'sediment layer' risk — old trust relationships established under looser security models may persist quietly in the background, and you cannot patch certificates minted in 2019 from within a 2024 threat model.
The hardening timeline matters here. Windows new service infrastructure consistently goes through a vulnerability discovery period as researchers map the fresh attack surface, followed by years of incremental patching. This pattern played out with Windows Defender components, Windows Store services, and various subsystem pieces. Cross Device Service is early in that cycle, which means more CVEs will likely follow.
Prioritization guidance: for mass exploitation campaigns and wormable scenarios, the 3% EPSS likely remains accurate. For enterprise networks where credential theft, insider threats, and targeted intrusion are in your threat model — which describes most corporate environments — treat this as higher blast radius than the score implies. The question isn't whether EPSS is calibrated correctly; it's whether you're optimizing for the right threat model. If your estate includes developers, IT admins, or users with device pairing enabled, this warrants expedited patching and active monitoring for post-exploitation toolkit behavior involving the Cross Device Service process.