CVE-2026-28757

Executive Summary

CVE-2026-28757 is an unpatched local privilege-escalation vulnerability in the user-mode (Ring 3) components of Intel Workload Services Framework (WSF). The root cause is a protection mechanism failure (CWE-693): a security control expected to constrain an unprivileged local adversary is absent, misconfigured, or bypassable, and a low-complexity attack requiring passive user interaction can elevate privileges. Organizations running WSF for workload orchestration face high confidentiality, integrity, and availability impact on the affected host; no public proof-of-concept, patch, or vendor advisory has been published to date.

Technical Analysis

Intel Workload Services Framework (WSF) is Intel's open-source framework for building, deploying, and managing containerized workloads across edge, on-premises, and cloud environments, including infrastructure used for confidential computing and telemetry-oriented workloads. The NVD description places the flaw in the portion of the framework operating in Ring 3 — i.e., ordinary user-space application code, rather than the kernel, hypervisor, or firmware. This is a meaningful constraint: the escalation occurs within an application-level security boundary, not via a kernel exploit.

The vulnerability is classified as CWE-693, Protection Mechanism Failure. Per the CWE definition, this occurs when a product "does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product." In this case, a WSF user-mode component that should enforce an authorization or capability boundary does not do so reliably. The specific failing control is not disclosed in any available source: the CNA title is empty, the affected version list is empty, and no vendor advisory exists. The report therefore does not name functions, endpoints, file paths, or APIs, as none have been published.

The disclosed attack conditions are:

• Local access — the adversary must have a local presence on the host; a remote-only position is insufficient.
• Low complexity — the attack does not require advanced skill, significant compute resources, or an elaborate multi-stage setup.
• No special internal knowledge — the attacker does not need privileged insight into the target, though the "attack requirements" (generic preconditions) must be present.
• Passive user interaction — a privileged user must perform a benign action (e.g., launching a routine workload or opening a file) that unknowingly delivers the attacker's condition into the privileged WSF context.
• Privileged user present — the NVD text describes an "unprivileged software adversary with a privileged user," indicating the attacker leverages the availability of an existing privileged account through interaction rather than by directly compromising that account.

The stated impact is high for confidentiality, integrity, and availability of the vulnerable system itself, while the "subsequent system" impacts are all none. This suggests the compromise is contained to the WSF application/host context and does not inherently propagate laterally.

No code-level technical detail, proof-of-concept, or in-the-wild exploitation evidence is available at this time. EPSS estimates a 0.00120 probability of exploitation (2.2nd percentile of scored CVEs), and the CVE is not present in the CISA Known Exploited Vulnerabilities catalog.

Exploitation Scenarios

Because no PoC or implementation details have been published, the attack chain below is reconstructed at the vulnerability-class level from CWE-693 and the NVD description. This is a scenario-level model, not a validated exploit walkthrough.

1. Reconnaissance / target identification. The adversary holds an unprivileged local account on a host running affected Intel WSF user-mode services. They enumerate running processes, services, scheduled tasks, and writable resources associated with the framework to identify the user context under which the vulnerable component executes and which protection mechanism is supposed to guard privileged operations. Since no special internal knowledge is required, standard OS enumeration is sufficient.

2. Triggering the flawed protection mechanism. The adversary prepares a condition — such as a crafted workload definition, a specially arranged local file or environment state, or a request submitted to a WSF user-mode service — that drives the component into a state where the deficient protection mechanism should have blocked the action but does not. The low-complexity classification implies this preparation is routine and repeatable. Passive user interaction is then required: a privileged user performs an innocuous action, such as launching a workload through the WSF interface, which delivers the attacker's input into the privileged context.

3. Payload / execution at the class level. Once the protection mechanism is bypassed, the attacker's code or commands execute with the privileges of the WSF component — a more-privileged user context than the attacker's starting point. At the class level, this yields a generic privilege-escalation primitive: code execution as the target user, creation or modification of files owned by that context, or manipulation of the framework's persistent state. No specific function names, API endpoints, or file paths are disclosed, so none are fabricated in this report.

4. Post-exploitation impact. With elevated privileges inside the WSF context, the adversary can read sensitive configuration and workload data, tamper with framework logic or stored state, and disrupt the availability of affected WSF services — consistent with the high/high/high CIA impact on the vulnerable system. The NVD's "subsequent system" impacts of none indicate no automatic cross-system propagation as an inherent consequence of this CVE; any lateral movement would require additional techniques outside the scope of this vulnerability.

Impact Assessment

Business impact. Intel WSF is used to orchestrate and provision workloads on Intel-based infrastructure, including environments handling sensitive data and trusted-execution workloads. A low-complexity, local privilege escalation in user-mode WSF components breaks the trust boundary these environments rely on: a compromised or malicious local user could gain the privileges of the WSF service account, manipulate workload deployments, exfiltrate secrets processed by those workloads, or disrupt orchestration availability.

Affected systems. Any host running an affected (as-yet-undisclosed) version of Intel WSF user-mode software. Because no affected version list has been published, the exposure cannot be precisely scoped; the affected population is best defined as "deployments of Intel Workload Services Framework software for which no patch has been released."

Blast radius. The NVD description quantifies the primary impact as confidentiality: high, integrity: high, availability: high for the vulnerable system, with subsequent-system impacts all none. This narrows the blast radius to the local host/application context. CVSS is not assigned (N/A) and no numeric vector is used in this report. Near-term in-the-wild exploitation is unlikely per EPSS (0.00120; 2.2nd percentile) and the absence of known exploits or KEV listing — but the unpatched status keeps risk non-negligible for security-sensitive WSF deployments.

Detection Guidance

The following detections are heuristic because no exploit samples exist publicly. They target the observable hallmarks of local privilege escalation around WSF processes rather than a unique exploit signature. Network-based detection (Suricata) is of limited value for a local-access flaw and is included only for the payload-delivery phase.

Sigma Rule

title: Suspicious Privilege Escalation via Intel Workload Services Framework
id: d1e5b8f2-1a3c-4e6f-9a0b-7c8d9e0f1a2b
status: experimental
description: Detects a non-root process spawning a root process in proximity to Intel Workload Services Framework activity on Linux hosts. Heuristic rule for CVE-2026-28757 (CWE-693 local privilege escalation); no public exploit signature exists.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-28757
author: ValtersIt Threat Intelligence
date: 2026/06/01
logsource:
    product: linux
    category: process_creation
detection:
    selection_wsf_context:
        ParentImage|contains:
            - 'wsf'
            - 'workload'
    selection_elevation:
        User: 'root'
        ParentUser: '!root'
    condition: selection_wsf_context and selection_elevation
falsepositives:
    - Administrators legitimately running privileged maintenance commands from a service manager
level: high
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026-28757

YARA Rule

rule intel_wsf_privesc_heuristic
{
    meta:
        author      = "ValtersIt Threat Intelligence"
        description = "Heuristic artifact scan for CVE-2026-28757. Flags binaries/scripts referencing Intel Workload Services Framework that contain generic privilege-escalation indicators. Not validated against real samples because none are public."
        cve         = "CVE-2026-28757"
        date        = "2026-06-01"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-28757"

    strings:
        $wsf_a = "Workload Services Framework" ascii wide nocase
        $wsf_b = "Intel(R) Workload Services" ascii wide nocase
        $wsf_c = "wsf" ascii wide nocase
        $priv_a = "SeDebugPrivilege" ascii wide
        $priv_b = "AdjustTokenPrivileges" ascii wide
        $priv_c = "setuid" ascii wide nocase
        $priv_d = "privesc" ascii wide nocase
        $priv_e = "euid" ascii wide nocase

    condition:
        filesize < 10MB and
        ( ( uint16(0) == 0x5A4D and 2 of ($wsf*) and 1 of ($priv*) ) or
          ( uint32(0) == 0x464C457F and 2 of ($wsf*) and 1 of ($priv*) ) )
}

Suricata IDS Rule

# CVE-2026-28757 is a LOCAL privilege escalation; network detection is limited.
# This rule targets the heuristic payload-delivery phase: an unprivileged user
# downloading a WSF-themed privilege-escalation tool from a remote host.
alert http any any -> any any (msg:"ET EXPLOIT Possible Intel WSF Privilege Escalation Payload Download (CVE-2026-28757)"; flow:established,to_server; content:"GET"; http_method; content:"privesc"; http_uri; nocase; content:"workload"; http_uri; nocase; classtype:attempted-admin; sid:2026287571; rev:1;)

Elastic Detection

sequence by host.id with maxspan=1m
  [ process where event.category == "process" and event.type == "start"
      and (process.args : "*wsf*" or process.name : "*wsf*") ]
  [ process where event.category == "process" and event.type == "start"
      and process.user.name == "root"
      and process.parent.user.name != "root" ]

Splunk SPL Query

index=linux sourcetype=linux_audit type=SYSCALL success=yes
| where euid=0 AND uid!=0
| eval privesc_indicator = "CVE-2026-28757_heuristic"
| table _time, host, user, uid, euid, exe, comm, pid, ppid

Wazuh OSSEC Rule

<group name="cve-2026-28757,">
  <rule id="100287" level="12">
    <if_sid>80700</if_sid>
    <field name="euid">^0$</field>
    <field name="uid">!^0$</field>
    <description>CVE-2026-28757 heuristic: privilege escalation - process executed with EUID 0 by non-root UID</description>
    <group>privilege_escalation,</group>
    <mitre>
      <id>1068</id>
    </mitre>
  </rule>
</group>

Note: the Wazuh rule references parent rule 80700 (standard auditd "New process" execve rule).

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No evidence of a fix exists from any tracked source, and no vendor advisory has been published. The following does not substitute for a vendor fix.

1. Immediate mitigations. Restrict local interactive access to WSF infrastructure to a small, vetted administrator group. Remove unprivileged accounts from WSF hosts wherever possible. Enforce least privilege for the WSF service account and disable unused WSF components to reduce attack surface. Warn privileged operators against performing routine WSF actions (opening workload definitions, launching workloads) in sessions where local untrusted users are present, given the passive-interaction precondition. Apply host hardening (ASLR/DEP, SELinux/AppArmor, mandatory access control) to raise the cost of exploitation.

2. Patch/upgrade steps. No patched version is available as of the reporting date. Subscribe to Intel Product Security Center notifications and Intel security advisories; test and deploy the vendor fix as soon as it is released. Until then, track CVE-2026-28757 in the organization's vulnerability management system with a manual review cycle, notified to all WSF platform owners.

3. Long-term hardening. Segment WSF hosts from general-purpose user workstations. Deploy EDR with the detection rules above and tune for local false positives. Perform routine audits of privileged access and service accounts. If Intel WSF is unmaintained in the deployment, evaluate compensating controls or migration to an actively maintained alternative.

References

• NVD entry for CVE-2026-28757: https://nvd.nist.gov/vuln/detail/CVE-2026-28757
• CWE-693 (Protection Mechanism Failure): https://cwe.mitre.org/data/definitions/693.html
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• Intel Product Security Center (subscribe for advisory when published): https://www.intel.com/content/www/us/en/security-center/default.html
• FIRST EPSS score lookup: https://www.first.org/epss/

No threat-actor campaigns or exploit-in-the-wild evidence associated with CVE-2026-28757 has been documented at the time of writing; CISA KEV does not list this CVE.