EUVD-2026-44060
GHSA-62wj-96fg-2fpq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local interactive access with standard user privileges confirmed by description; high confidentiality impact only, no integrity or availability effect, unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
AnalysisAI
Windows File Explorer on a wide range of Microsoft Windows client and server versions exposes sensitive information to locally authenticated standard users, achieving high confidentiality impact without requiring elevated privileges. The flaw (CWE-200) is confined to the local attack surface - CVSS AV:L/PR:L - meaning the attacker must already hold an interactive session on the target system. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor patch is available through Microsoft Security Response Center.
Technical ContextAI
Windows File Explorer (explorer.exe) is the integrated shell and file management component shipped with all Windows client and server editions. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) covers scenarios where an application fails to properly restrict access to data - common manifestations in File Explorer include improper access controls over MRU (most recently used) lists, thumbnail caches, named pipe communications, or shell metadata structures that may reference or expose content belonging to other users or elevated processes. The CVSS unchanged scope (S:U) confirms the exposure does not escape the security boundary of the Explorer component itself. CPE data confirms the flaw spans the Microsoft Windows product line from Windows Server 2012 through Windows 11 Version 26H1, indicating a long-standing architectural pattern rather than a regression introduced in a single release.
RemediationAI
The primary remediation is to apply the vendor-released patch documented in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50456. The exact KB article number and patched build version are not confirmed in the provided input data and should be retrieved directly from the MSRC advisory, which lists per-version update packages. As an interim compensating control where immediate patching is not possible, restricting interactive logon rights on sensitive systems (via Group Policy: 'Allow log on locally') limits the pool of users who could exploit the local attack vector; however, this does not remediate the underlying flaw and has operational trade-offs for service accounts and remote desktop users. In multi-user environments such as RDS or terminal servers, enforcing strict file system ACLs on sensitive data directories reduces the scope of information potentially exposed through the Explorer flaw. Prioritize patching on shared-access systems, where the local-user attacker model is most realistic.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today