Windows Server 2012 EUVD-2026-22516

The CVSS 5.5 score reflects a medium-severity information disclosure with confidentiality impact rated high, but integrity and availability unaffected. The EPSS exploitation probability data is not provided in the input, limiting quantitative risk modeling. The attack vector is local (AV:L) with required low privileges (PR:L), significantly constraining real-world attack surface compared to network-based vulnerabilities; an attacker must already possess valid credentials and system access. The lack of any CISA KEV or publicly available exploit code designation indicates no confirmed active exploitation at time of analysis. Within SSVC framework, this represents a low-immediacy risk due to local-only attack vector and authentication requirement, though organizations managing shared systems or those with elevated insider threat concerns should prioritize patching. The breadth of affected versions (Windows 10 1607 through 11 26H1, Server 2012-2025) suggests this touches legacy and modern systems; however, the information-disclosure-only impact and local-access requirement make this a lower-urgency priority than remote code execution or privilege escalation flaws.

An authenticated user with standard (non-administrator) privileges on a Windows system uses File Explorer to access files or directories they do not have explicit permissions to read. The vulnerability in File Explorer's access control allows them to view sensitive data such as system configuration files, user documents from other accounts, or application secrets without triggering audit logs or permission denial. This could occur in shared systems, corporate environments with weak local access controls, or compromised accounts escalating information gathering before further attacks.