Windows Shell CVE-2026-70563

User interaction is required: the victim must actively access, open, or navigate to an attacker-controlled path or shortcut that triggers Windows Shell's link-resolution logic. The attack is network-based (AV:N) meaning the attacker-controlled resource can reside on a remote share or network path rather than requiring local access. No authentication from the attacker is required (PR:N), but the victim must be a valid Windows user with the ability to interact with the Shell (i.e., a desktop or Explorer session, or a server-side Shell invocation). Non-default configurations are not required - default Windows installations are affected. Exploitation is constrained by: (1) mandatory victim interaction, (2) the need to deliver a crafted link to the victim through phishing, shared drives, or web content, and (3) the absence of scope change (S:U) meaning the attacker does not automatically pivot beyond the victim's session context.

The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) accurately reflects the threat model: network-reachable, no authentication required, but user interaction is the key friction point. EPSS data is not provided, limiting probabilistic exploitation forecasting. No CISA KEV listing and no public POC have been identified at time of analysis, which tempers urgency. However, the combination of a no-privilege-required network vector with high C and I impact - and the breadth of affected platforms covering essentially all supported Windows versions plus end-of-life Server 2012/2012 R2 - gives this a meaningful real-world risk profile. The single mitigating factor is the mandatory user interaction requirement. The 'Authentication Bypass' tag in the input metadata is inconsistent with the description, which characterizes the impact as spoofing via link following - this tag may be inaccurate and should be verified against the Microsoft Security Response Center advisory.

An attacker hosts a crafted Windows shortcut (.lnk) or reparse-point-backed file on an attacker-controlled SMB share or web server and induces the victim to access it - for example, via a phishing email, malicious web page embedding a UNC path, or a poisoned shared folder. When Windows Shell resolves the link before the file access operation, it follows the attacker-supplied target rather than the intended path, allowing the attacker to read sensitive files (C:H) or redirect writes to overwrite arbitrary targets (I:H). No public POC has been identified at time of analysis, but link-following primitives in Windows Shell have historically been reliable exploitation targets.