Windows Server 2012 CVE-2026-32217

CVSS 5.5 with attack vector local (AV:L), low complexity (AC:L), and low privilege requirement (PR:L) reflects a moderate but real risk. The high confidentiality impact (C:H) combined with no integrity or availability impact indicates this is a pure information disclosure weakness. CVSS severity alone does not fully capture the risk: the requirement for local authenticated access significantly reduces the attack surface compared to network-exploitable vulnerabilities, but the ability for any standard user to read sensitive kernel information is a meaningful breach of confidentiality. SSVC perspective shows exploitation is straightforward (AC:L, PR:L), technical impact is high (confidentiality), and scope is unchanged (user boundary not crossed). The widespread patch availability and lack of any indication of active exploitation or public POC suggest this is a lower priority than the CVSS score alone might imply, though remediation is still necessary for systems handling sensitive workloads. Organizations managing privileged users or high-security environments should prioritize patching.

A standard domain user or local user on a Windows system gains access to the machine through legitimate credentials or by compromising a user account. The attacker then reads the Windows Kernel log files, which are accessible to authenticated users with minimal privileges, and extracts sensitive information such as credentials, API keys, session tokens, or other confidential data that was inadvertently logged by the kernel. The attacker can perform this offline or through programmatic access to log files without requiring elevated privileges or triggering administrative alerts.