Windows Server 2016 CVE-2026-32081

CVSS 5.5 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects moderate risk but with notable constraints. Attack Vector Local (AV:L) and Privilege Requirement Low (PR:L) mean only local authenticated users can exploit this; remote attackers cannot. Attack Complexity Low (AC:L) indicates no special conditions are needed once a user is authenticated. Confidentiality Impact High (C:H) confirms sensitive data disclosure is possible, while Integrity (I:N) and Availability (A:N) are unaffected. The lack of remote exploitability and requirement for local authentication significantly reduce real-world risk compared to the CVSS numeric score alone. No public exploit code or CISA KEV listing appears in the available data, suggesting this is not actively exploited in the wild. This is a legitimate local privilege escalation or information leakage issue relevant primarily to multi-user systems, shared workstations, or scenarios where an attacker has obtained low-privilege user credentials. Organizations with strong access controls and limited local user populations face lower practical risk than those with permissive user account policies.

A low-privileged local user with standard user credentials logs into a shared Windows 10 or Windows 11 workstation and opens File Explorer. By navigating the file system or accessing specific file properties, the user exploits the information disclosure vulnerability to view sensitive metadata, file attributes, or system information that would normally be restricted by access controls. For example, an attacker might view restricted file contents or system paths that should be inaccessible to their privilege level. No special interaction, scripts, or user