Windows File Explorer CVE-2026-33842

Exploitation requires the attacker to hold a valid low-privileged local account or active session on the target system, consistent with CVSS PR:L and AV:L. The attacker must use Windows File Explorer - the built-in shell component - to trigger the disclosure; no network access, no special Windows features, and no non-default configuration are identified as prerequisites. The primary factors limiting exploitation are: (1) local access is mandatory - no remote or network-based exploitation path exists; (2) the attacker must be authenticated with at least a standard user account - unauthenticated exploitation is impossible; (3) the attack is not automatable per SSVC, ruling out large-scale scripted campaigns; and (4) only confidentiality is impacted, with no ability to modify data or disrupt availability (I:N, A:N). Defenders should assess risk based on their exposure to insider threats, compromised endpoint scenarios, or shared-access systems (VDI, RDS) where low-privileged users are common.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N yields a Medium score of 5.5, but the real-world risk must be weighted against multiple additional signals. The local-only attack vector is the most significant constraint: exploitation is impossible without prior authenticated access to the target system, making this useless as an initial access vector. EPSS at 0.36% (28th percentile) places this in the bottom third of vulnerabilities by observed exploitation probability, and CISA's SSVC framework independently rates exploitation as 'none' with a non-automatable attack pattern and only partial technical impact. The vulnerability is absent from CISA KEV, confirming no confirmed in-the-wild exploitation at time of analysis. Taken together, these signals are consistent: this is a real but low-urgency information disclosure issue best addressed through normal monthly patching cadence. The breadth of affected products (essentially all supported Windows versions) argues for complete patching rather than selective remediation, but emergency action is not warranted based on available data.

A threat actor who has obtained low-privileged credentials through phishing, credential stuffing, or an earlier compromise logs into a target Windows workstation or server. By navigating Windows File Explorer and interacting with a specific view or path that triggers the CWE-200 disclosure condition, the attacker reads sensitive data - such as internal system paths, cached tokens, or restricted file metadata - without any elevated rights or interaction from other users. No public exploit code has been identified at time of analysis, so exploitation currently requires manual discovery of the disclosure trigger.