Windows File Explorer CVE-2026-50389

Exploitation requires an authenticated local session on the affected Windows system with at least low-privilege (standard user) rights, confirmed by CVSS PR:L and AV:L. The attacker must be physically present or have established remote desktop/terminal services access to the machine. The disclosure is local-only - there is no network-reachable attack surface. Limiting factors include: no unauthenticated attack path exists; remote-only attackers without an established session cannot exploit this; the SSVC Automatable rating of 'no' means this cannot be scripted for mass exploitation without per-target human or session interaction. The specific File Explorer feature, navigation path, or configuration trigger that causes the disclosure is not described in available public data - the exact condition is not confirmed beyond the product and CWE classification.

The CVSS 3.1 base score of 5.5 (Medium) is consistent with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - confidentiality impact is rated High, but the local-only attack vector and low-privilege requirement substantially limit realistic exposure. The EPSS score of 0.47% (38th percentile) indicates very low probability of observed exploitation in the near term. CISA SSVC corroborates this: Exploitation status is none, Automatable is no (manual local session required), and Technical Impact is partial - all pointing toward a lower operational priority. The combination of no KEV listing, no public POC, low EPSS, and a non-automatable attack path means this is a genuine vulnerability worth patching on schedule but not an emergency requiring out-of-band action. The primary real-world risk scenario is insider threat or post-compromise lateral information gathering, not mass automated attack.

A low-privileged local user - such as a standard domain account on a shared workstation or a lateral-movement foothold obtained via phishing - browses to a specific location in Windows File Explorer, triggering the disclosure of sensitive information they would not normally be authorized to view, such as file contents, metadata, or path information belonging to higher-privileged users or system processes. No public exploit code has been identified at time of analysis, so exploitation likely requires attacker knowledge of the specific trigger condition. This scenario is most relevant in multi-user environments, RDS/VDI deployments, or post-compromise situations where an attacker seeks to harvest credentials or sensitive data without requiring privilege escalation.