EUVD-2026-44138
GHSA-p69r-hhhv-jgqh
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access with low privileges is required to reach the cryptographic service; only confidentiality is impacted, with no integrity or availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally.
AnalysisAI
Windows Cryptographic Services on multiple Windows 10, Windows 11, and Windows Server editions contains a CWE-200 information disclosure flaw that allows a locally authenticated attacker with standard user privileges to read sensitive cryptographic material they should not be authorized to access. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation is entirely local and requires a pre-existing low-privilege session, positioning this as an insider threat or post-compromise scenario rather than an initial access vector. No public exploit code has been identified, CISA SSVC rates exploitation as none, and EPSS sits at only 0.47%, collectively indicating low real-world exploitation activity at time of analysis.
Technical ContextAI
Windows Cryptographic Services encompasses the CryptoAPI and Cryptography Next Generation (CNG) subsystems, which underpin key storage, certificate management, digital signatures, and encryption operations across the Windows platform. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as an improper access control within this subsystem, where a lower-privileged process or user account can read cryptographic material-such as private keys, certificates, or protected session data-that access controls should restrict. The CPE data confirms the flaw spans Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 24H2, 25H2, 26H1), and Windows Server 2016, 2019, 2022, and 2025, indicating the vulnerable code path exists across a broad, multi-generation Windows codebase. No memory corruption primitive is implied; the failure is an authorization boundary violation within the cryptographic service layer.
RemediationAI
Apply the vendor-released security update published by Microsoft, which addresses all affected Windows 10, Windows 11, and Windows Server versions. Confirmed patched build thresholds from EUVD are: Windows 10 1607 and Server 2016 at 10.0.14393.9339 or later; Windows 10 1809 and Server 2019 at 10.0.17763.9020 or later; Windows 10 21H2 at 10.0.19044.7548 or later; Windows 10 22H2 at 10.0.19045.7548 or later; Windows Server 2022 at 10.0.20348.5386 or later; Windows 11 24H2 and Server 2025 at 10.0.26100.33158 or later; Windows 11 25H2 at 10.0.26200.8875 or later; and Windows 11 26H1 at 10.0.28000.2269 or later. The official patch guidance is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50681. As a compensating control prior to patching, restrict local interactive and Remote Desktop sessions to trusted, vetted users on sensitive systems; enforce least-privilege account policies to minimize the pool of accounts that could exploit this flaw; and enable CNG audit policies and Windows Event Logging to detect anomalous access to cryptographic key stores. Note that restricting CryptoAPI/CNG access broadly may disrupt applications dependent on shared certificate stores or key containers.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today