Windows Server 2019 CVE-2026-20806

This is a moderate-risk information disclosure vulnerability that warrants priority patching despite a moderate CVSS score of 5.5. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates low attack complexity and high confidentiality impact, meaning exploitation is straightforward once an attacker has local user access. The requirement for PR:L (authenticated user) and AV:L (local access) significantly reduces real-world exploitability compared to remote unauthenticated attacks; however, the high confidentiality impact (C:H) reflects that sensitive data-such as cryptographic keys, authentication tokens, or personal information-could be disclosed from kernel or privileged process memory. The broad affected product range (Windows 10/11, multiple versions, and Server editions) and the low attack complexity indicate this is a practical insider threat or post-compromise information-gathering vector. The lack of integrity or availability impact means this is not suitable for lateral movement or privilege escalation on its own, but disclosed secrets could be weaponized in follow-on attacks. Microsoft's timely patch availability and the lack of public exploit code at the time of analysis suggest this is not yet actively exploited in the wild, reducing urgency slightly but not eliminating the need for timely patching of systems handling sensitive data.

A local authenticated user with standard user privileges identifies that the Windows COM subsystem is vulnerable on their system. The attacker crafts a malicious COM application that exploits the type confusion flaw to access memory regions belonging to a higher-privilege process or system service, reading cryptographic keys, authentication tokens, or other sensitive data stored in memory. The attack requires no user interaction (UI:N) and executes within the user's existing session, making it difficult to detect via standard endpoint monitoring.