Windows Storage CVE-2026-96944

Exploitation requires the attacker to already have an authenticated, interactive local session on the affected Windows host (AV:L, PR:L = valid low-privileged credentials), with no user interaction needed (UI:N). The flaw is the Windows Storage component placing sensitive information into a file or directory that is accessible to lower-privileged users than intended (CWE-538); the attacker simply reads that externally-accessible location. LIMITING FACTORS: it cannot be exploited remotely or by an unauthenticated user, impact is confidentiality-only (no integrity or availability loss, S:U so no privilege/scope escalation), and affected systems must be unpatched Windows 11 (builds below 24H2 10.0.26100.9711 / 25H2 10.0.26200.9711 / 26H1 10.0.28000.3231 / 26H2 10.0.26300.9711) or Windows Server 2022 (<10.0.20348.5761) / 2025 (<10.0.26100.33650).

This is a moderate-severity information disclosure flaw (CVSS 5.5) with multiple signals pointing to LOW real-world urgency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires LOCAL access and LOW privileges (PR:L = an authenticated, logged-on user), limiting it to attackers who already have a foothold on the host - it is not remotely exploitable. CISA's SSVC decision framework reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be mass-scaled), Technical Impact=partial. No EPSS score was provided in the input, and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation. No POC/exploit code is referenced. The signals are consistent rather than conflicting: a confidentiality-only (C:H/I:N/A:N) local disclosure bug that Microsoft self-reported and has already patched. Verdict: a legitimate patch-in-normal-cycle issue, NOT an emergency - the high confidentiality impact is tempered by the local attack vector and required authentication, making widespread or automated exploitation unlikely.

An attacker who has already gained an authenticated local session on a Windows host (e.g., a standard low-privileged user or via prior compromise) abuses the Windows Storage component to read sensitive information that was improperly written into an externally-accessible file or directory (CWE-538). Because the CVSS vector is AV:L/PR:L, this requires existing local access and low-level privileges - it cannot be triggered remotely or by an anonymous user. No public exploit identified at time of analysis.