Windows WebDAV CVE-2026-88137

Exploitation requires (1) the WebDAV component to be present and network-reachable on the target Windows host, and (2) the attacker to hold a valid low-privilege authorization (PR:L) - it is NOT remote-unauthenticated. Per CVSS, attack complexity is low and no user interaction is needed (AC:L/UI:N), so once authenticated the request is straightforward. Limiting factors that reduce real-world risk: the authentication requirement, the fact that WebDAV must actually be enabled/exposed (not universally on by default across all listed SKUs), and CISA SSVC assessing the attack as non-automatable with only partial technical impact. The precise WebDAV feature/configuration that must be active is not specified in the available description and should be verified against the Microsoft MSRC advisory.

This is a moderate-severity information disclosure flaw in the Windows WebDAV component (CWE-552). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity attack, but critically requires PR:L - the attacker must already hold some level of authorization. Impact is confidentiality-only and high (C:H/I:N/A:N) with an unchanged scope. The signals are internally consistent and point AWAY from an urgent, mass-exploitation priority: CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', and no EPSS score, KEV listing, or public POC is present in the provided data. The combination of required authentication plus non-automatable, partial-impact exploitation makes this a meaningful but not top-tier patch priority - more relevant to environments where WebDAV is exposed and low-privilege accounts are plentiful (e.g., shared/enterprise servers). Note the ceiling, however: C:H means a successful attack can disclose sensitive file contents, so it should not be dismissed. No key signals conflict; the main caveat is that the terse description does not specify exactly what information is exposed or under what WebDAV configuration.

An attacker who already possesses a low-privilege authenticated foothold (e.g., a standard user or a low-trust account on a server running WebDAV) sends crafted WebDAV requests over the network to a vulnerable Windows host and retrieves files or directory contents that should not be accessible to their privilege level. No user interaction is required and attack complexity is low, but no public exploit code has been identified at time of analysis.