Windows SMB Server CVE-2026-69403

Exploitation requires the attacker to have an active local session on the target Windows system - either physical local logon, Remote Desktop (RDP) access, or an equivalent session - with at minimum low-privilege (standard user) credentials (CVSS PR:L). The Windows SMB Server service must be running, which is the default on all affected Windows versions. No special non-default configuration is required beyond the attacker holding any valid local or domain account on the machine. Exploitation is limited by the local attack vector (AV:L): a purely remote unauthenticated attacker cannot reach the vulnerable code path. Additional limiting factor: impact is strictly read-only information disclosure (I:N/A:N), so the attacker cannot modify data or cause service disruption through this vulnerability alone.

The CVSS base score of 5.5 (Medium) accurately reflects the constrained attack surface: AV:L requires the attacker to already have local access or an established session on the target system, and PR:L means at minimum low-privilege credentials are required. EPSS data is not provided, and neither KEV listing nor public POC code has been identified, suggesting opportunistic exploitation is unlikely in the near term. The high confidentiality impact (C:H) is the primary risk driver and could be meaningful in multi-tenant or shared Windows environments (e.g., RDS servers, Citrix environments) where low-privileged users should be isolated from each other's SMB-accessible data. The 'Authentication Bypass' tag in the input metadata is a mislabel - this is a missing authorization (post-authentication) flaw, not a bypass of authentication itself; the CVSS PR:L confirms an attacker must authenticate first. Real-world priority is elevated for environments where untrusted or semi-trusted local users exist on SMB-serving Windows systems, but is low for single-user workstations or strictly managed endpoints.

A low-privileged domain user authenticated to a Windows Server 2025 Remote Desktop Services host executes a crafted SMB request targeting the local SMB Server endpoint, bypassing the missing authorization check to read sensitive named-pipe or share metadata inaccessible to their privilege level. No public exploit code has been identified, so this scenario currently requires custom tooling or manual API abuse. The local attack vector limits this to attackers who already hold valid credentials on the target system.