EUVD-2026-100119
GHSA-v5m2-2mxj-xh3j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryInteract with Projected File System interface
-
ExploitExploit improper access control / path traversal
-
ExecutionRead files outside authorization boundary
-
ImpactDisclose sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to an affected Windows host with at least low-level (standard user) privileges, per AV:L/PR:L, and specifically involves the Windows Projected File System (ProjFS) component; there is no network vector and no user interaction. Limiting factors: the attacker must already be able to execute code or interact locally as an authenticated low-privileged principal, impact is confined to confidentiality (information disclosure only - no integrity or availability effect), and the scope is unchanged. This makes it a post-access or insider-style step rather than a remotely reachable entry point. |
| Impact | This is a moderate-severity, local information-disclosure flaw whose signals are consistent and point toward low real-world urgency rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) requires local access and at least low privileges, yielding high confidentiality impact but no integrity or availability impact. CISA's SSVC decision framework reinforces this: Exploitation 'none' (no observed or public exploitation), Automatable 'no' (local vector cannot be scripted at scale), and Technical Impact 'partial'. No EPSS score was provided, and the CVE is not listed in CISA KEV, so there is no public exploit identified at time of analysis. The signals do not conflict - a local, authenticated, confidentiality-only bug that is not automatable is a routine patch-cycle item, not a drop-everything priority. The main caveat is the sheer deployment footprint: because it affects core Windows across client and server SKUs, the aggregate exposure is large even though per-host risk is modest. |
| Exploit ScenarioDerived | A low-privileged local user (or malware already running in a standard user context) abuses improper access control in the Windows Projected File System (ProjFS) to perform path traversal and read files whose contents should be outside their authorization boundary. Because the attack vector is local and requires existing low-level privileges with no user interaction, it is most realistic as a post-compromise or insider step to harvest sensitive data. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local information disclosure in the Microsoft Windows Projected File System (ProjFS) component allows an authenticated, low-privileged attacker with local access to read data they should not be able to reach, most plausibly by traversing outside the intended projection root (CWE-22). Impact is confidentiality-only (CVSS 5.5, AV:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect, and there is no network vector or user-interaction requirement, so it is a post-access or insider-style step rather than a remotely reachable entry point. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and automatable as no; Microsoft has released fixes.
RemediationAI
Apply the Microsoft monthly security update that contains the ProjFS fix: vendor-released patch is available per the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70084), with the affected ranges closing at builds such as 10.0.19044.7807 for Windows 10 22H2, 10.0.17763.9376 for Windows 10 1809 and Windows Server 2019, 10.0.22631.7652 for Windows 11 23H2, 10.0.26100.9711 and 10.0.26300.9711 for Windows 11 24H2/26H2, 10.0.26200.9711 for Windows 11 25H2, 10.0.28000.3231 for Windows 11 26H1, 10.0.20348.5761 for Windows Server 2022, and 10.0.26100.33650 for Windows Server 2025; verify installed builds with WinVer or Get-ComputerInfo and prioritize internet-facing and multi-user/VDI hosts where unprivileged users already have local execution. Because exploitation requires local low-privileged access and yields disclosure only, compensating controls are viable while patching: restrict enablement and use of ProjFS projections (the Enable-ProjectedFileSystem feature and any registered providers require administrative action) so only trusted, vetted providers run on shared systems, at the cost of breaking developer workflows such as virtualization-for-Git or hydration-based repositories; audit and ACL projection roots and their backing stores so an unprivileged principal cannot read the underlying data even if a traversal is triggered, which reduces exposure without eliminating the path-handling defect; and limit local interactive/RDP logon and script execution for untrusted accounts, trading operational flexibility for a smaller pre-condition surface. No public exploit code has been identified, so these controls are precautionary rather than emergency measures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ProjFS is a Windows user-mode API/component that lets a file-system provider project a hierarchical data store into a directory as if it were ordinary NTFS content, materializing files on demand and keeping the backing store hidden behind the projected view; it underpins tooling such as virtualization for Git and other hydration-based file system drivers. The flaw is classified CWE-22 (improper limitation of a pathname to a restricted directory, i.e. path traversal) and described by the vendor as improper access control, which points to insufficient canonicalization or validation of paths supplied to the projection layer: crafted path input (for example traversal sequences, alternate separators, or reparse-point redirection) can resolve outside the projected root and expose files that the caller's privilege level should not permit reading. The CVSS vector places the attack surface firmly local (AV:L) with low privileges required (PR:L) and no UI interaction, and the unchanged scope (S:U) indicates the attacker stays within the same security authority, consistent with an authenticated low-privileged local process escalating its read access through the ProjFS path-handling logic rather than crossing a trust boundary.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local vector and standard-user privileges are needed to reach ProjFS (AV:L, PR:L, AC:L); impact is confidentiality-only information disclosure, so C:H with I:N and A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper access control in Windows Projected File System allows an authorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB