Windows File Explorer CVE-2026-41087

Exploitation requires a locally authenticated session with at least standard low-privilege user rights (PR:L per CVSS) on an affected Windows system running a vulnerable build. The attack vector is strictly local (AV:L) - no network-based exploitation path is indicated. No user interaction from a privileged user or victim is required (UI:N). No non-default configuration or special feature enablement is indicated as a prerequisite. Limiting factors: the attacker must have interactive console, RDP, or terminal services access; exploitation is not automatable (SSVC) so mass or remote exploitation is not feasible; impact is limited to confidentiality only with no code execution or privilege escalation possible through this flaw alone. Environments where all local users are fully trusted face negligible practical risk.

The CVSS 3.1 score of 5.5 (Medium) is appropriate for this local-only disclosure flaw - the AV:L constraint sharply limits the attacker pool to those who already have interactive or RDP access. EPSS at 0.36% (28th percentile) indicates low short-term exploitation probability, consistent with SSVC's rating of exploitation 'none' and automatable 'no,' meaning no observed active exploitation and no viable mass-exploitation path. The vulnerability is absent from CISA KEV, confirming no confirmed in-the-wild exploitation at time of analysis. Despite the High confidentiality impact (C:H), the absence of integrity or availability impact (I:N/A:N) and the local-only, authenticated prerequisite reduce operational urgency significantly compared to network-exploitable or unauthenticated disclosure flaws. Real-world risk is highest in environments with multiple untrusted local users - shared workstations, VDI/RDS deployments, and multi-tenant systems - where a low-privilege user could access information belonging to other users or elevated system contexts. For single-user workstations in controlled environments, risk is materially lower. No conflicting signals between data sources were identified.

A low-privileged user who has logged into a shared Windows terminal server or RDS session opens Windows File Explorer and navigates to or triggers a specific condition that inadvertently surfaces sensitive information - such as file metadata, path data, or cached system content - from a context beyond their authorization level. No public exploit code exists at time of analysis, and the low attack complexity (AC:L) suggests that once local access is obtained, no specialized tooling would be required to trigger the disclosure.