Windows File Explorer CVE-2026-50473

Exploitation requires an authenticated local session with at minimum a low-privileged user account (PR:L, AV:L per CVSS vector). The attacker must have the ability to interactively use Windows File Explorer on the target system, which limits exploitation to scenarios where an adversary already has local console, RDP, or terminal access. No network-based remote triggering has been indicated. No user interaction from a second user is required (UI:N). Exploitation is limited to confidentiality - no write or denial-of-service capability is present (I:N, A:N). On Windows Server Core installations, the reduced shell environment may further constrain practical exploitation, though these versions are listed as affected. SSVC confirms the vulnerability is not automatable, meaning scripted mass exploitation across networks is not a realistic threat model.

The aggregate risk signal is low-to-moderate despite the CVSS 5.5 medium score. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms this requires physical or terminal access with a low-privilege account - an attacker must already have a foothold on the target host. EPSS at 0.36% (28th percentile) is notably low, suggesting exploitation is not observed at scale and attack tooling has not been publicly developed. CISA SSVC further classifies exploitation as 'none' and the vulnerability as 'not automatable' with only 'partial' technical impact, which collectively argues against emergency prioritization. The vulnerability is not listed in CISA KEV, and no proof-of-concept has been reported. The primary real-world concern is post-compromise lateral reconnaissance - an attacker who already has local access using File Explorer to read restricted sensitive data - rather than initial access or remote exploitation. The high confidentiality impact (C:H) in CVSS reflects potential exposure of sensitive file content or path data, but the local-only constraint significantly narrows the attack surface.

A low-privileged domain or local user with an interactive logon session on a vulnerable Windows host opens File Explorer and navigates to or interacts with a location containing restricted file data. Through the vulnerability, the user is able to read sensitive information - such as file contents, metadata, or directory paths - that access control policies should prevent them from seeing. No public exploit code has been identified at time of analysis, and the attack is non-automatable per SSVC assessment.