Windows Server 2016 EUVD-2026-22511

Despite a moderate CVSS 5.5 score, real-world risk is constrained by several mitigating factors. The vulnerability requires PR:L (low privilege authentication), meaning the attacker must already have valid local system access as an authenticated user-this is a significant prerequisite barrier. The scope is unchanged (S:U), limiting impact to the affected system only. Attack complexity is low (AC:L), indicating no special conditions are needed beyond local access. Confidentiality is high (C:H), confirming sensitive data disclosure, but integrity and availability remain unaffected (I:N, A:N). No public proof-of-concept, active exploitation (KEV), or EPSS score is documented in provided data, suggesting this is a lower-priority disclosure compared to unauthenticated remote vulnerabilities. For organizations, this is a patch-when-available issue rather than an emergency response scenario, though it may warrant prioritization in environments where local user privilege escalation or insider risk is a concern.

A local authenticated user with standard user privileges logs into a Windows 10 or Windows 11 system. By navigating through File Explorer or leveraging file access APIs, the attacker circumvents intended access restrictions and reads sensitive files they should not have permission to access-such as cached credentials, configuration files, or other users' documents. The low attack complexity and lack of user interaction requirements mean exploitation is straightforward once local access is obtained, though the attacker must already be authenticated to the system.