Windows URL Moniker CVE-2026-73019

Exploitation requires user interaction: the victim must click or activate a crafted URL delivered via phishing, malicious document, or web content (UI:R per CVSS). No attacker privileges are required (PR:N), and the attack is reachable over the network. The flaw affects all listed Windows versions in their default state - no special feature enablement beyond the presence of the URL Moniker component is required, and that component ships with all affected Windows builds. The primary limiting factor is user interaction; fully automated, zero-click exploitation is not possible per the CVSS vector. Impact is constrained to low confidentiality (C:L): the attacker can bypass a URL security check to access normally-blocked content but cannot modify system state or cause availability loss.

The CVSS 4.3 base score (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a moderate, user-assisted security feature bypass with limited confidentiality impact and no write or availability consequences. Attack complexity is low and no privileges are required on the attacker side, but user interaction is mandatory, preventing fully automated exploitation. No EPSS data was provided in the input. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified. The broad platform footprint - 19 distinct Windows product-version ranges spanning Server 2012 through Windows 11 26H1 - increases aggregate enterprise exposure significantly. Real-world prioritization should be moderate: address via normal Patch Tuesday cadence, but this does not warrant emergency change control given the limited impact ceiling and the user-interaction prerequisite.

An attacker embeds a crafted URL using an alternate path encoding or equivalent syntactic form in a phishing email or malicious document and delivers it to a Windows user. When the victim clicks the link, Windows URL Moniker processes the URL, fails to correctly resolve the path equivalence, and bypasses the applicable security check - such as security zone enforcement or SmartScreen - allowing the attacker to load or redirect to content from a resource that would otherwise be blocked. No public exploit code has been identified at time of analysis.