Windows Shell CVE-2026-42906

Exploitation requires an authenticated local user account with at minimum low-privilege access (PR:L per CVSS), confirming this is not an unauthenticated attack. The attacker must have interactive local access to the affected Windows system - remote network-only access is insufficient (AV:L). No user interaction from a second user is required (UI:N), meaning the attacker can trigger disclosure independently. The specific Windows Shell feature, configuration setting, or operation that triggers the information disclosure is not described in the available data - the exact triggering condition must be confirmed via the MSRC advisory. Exploitation is limited by the local access requirement: attackers without an existing local session or logon capability cannot exploit this remotely. The unchanged scope (S:U) means the attacker cannot leverage this vulnerability to pivot beyond the Shell's own security context.

The CVSS base score of 5.5 (Medium) is consistent with the vector breakdown: local access is required (AV:L), privileges are low but non-zero (PR:L), complexity is low (AC:L), and impact is limited to confidentiality (C:H/I:N/A:N). This is a genuine medium-severity issue, not a miscalibrated high-CVSS-low-risk case - the local-only attack vector meaningfully constrains exploitability. EPSS data was not provided in the source intelligence, so probabilistic exploitation likelihood cannot be assessed quantitatively. KEV status is not listed, and no POC code has been identified, placing this in the lower-urgency tier for most enterprise environments. However, the high confidentiality impact is notable: if sensitive data exposed includes credentials, tokens, or PII, downstream impact could exceed the base score in practice. Organizations with multi-tenant or shared workstation environments, kiosks, or environments where untrusted low-privileged users have local shell access should treat this with higher priority than the score alone suggests.

A low-privileged local user - such as a shared workstation account, a guest user, or a compromised service account with interactive logon rights - triggers a Windows Shell operation that inadvertently exposes sensitive information stored or processed by the Shell, such as file system paths, tokens, or environment variables belonging to higher-privileged processes. The attacker reads this disclosed data without any interaction from another user. No public exploit code has been identified, so exploitation currently requires manual discovery or access to non-public techniques.