What is the CVSS score of EUVD-2026-22597?

EUVD-2026-22597 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-22597?

Yes, a patch is available for EUVD-2026-22597. Update the affected software to the latest version immediately.

Microsoft EUVD-2026-22597

| CVE-2026-32215 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-04-14 microsoft

Information Disclosure Microsoft

5.5

CVSS 3.1 · NVD

Temporal: 4.8

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

4.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 19:41 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22597

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

MEDIUM 5.5

DescriptionCVE.org

Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.

AnalysisAI

Windows Kernel logs sensitive information that authenticated local users can read, enabling information disclosure on Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), Windows Server 2019, 2022, and 2025. An authorized local attacker with user-level privileges can access kernel log files to retrieve confidential data without elevated rights or user interaction. Microsoft has released patches addressing this CWE-532 insertion-of-sensitive-information vulnerability with specific build fixes across all affected editions.

Technical ContextAI

This vulnerability stems from CWE-532 (Insertion of Sensitive Information into Log File), where the Windows Kernel inappropriately logs sensitive data that should not be persisted. The affected versions span Windows 10 and 11 client operating systems, along with Windows Server editions (2019, 2022, 2025). The vulnerability is rooted in kernel-level logging mechanisms that fail to filter or sanitize sensitive information before writing to accessible log files. Because the attack vector is local (AV:L) with low complexity (AC:L) and only requires user-level privileges (PR:L), the exposure depends on log file permissions and whether a logged-in user can read kernel logs on their system. The technical impact is limited to confidentiality (C:H) with no integrity or availability impact, characteristic of information disclosure flaws.

RemediationAI

Apply vendor-released patches from Microsoft covering all affected Windows and Windows Server versions. For Windows 10 Version 1809, update to build 10.0.17763.8644 or later. For Windows 10 Version 21H2, update to build 10.0.19044.7184 or later. For Windows 10 Version 22H2, update to build 10.0.19045.7184 or later. For Windows 11 Version 22H3 and 23H2, update to build 10.0.22631.6936 or later. For Windows 11 Version 24H2, update to build 10.0.26100.32690 or later. For Windows 11 Version 25H2, update to build 10.0.26200.8246 or later. For Windows 11 Version 26H1, update to build 10.0.28000.1836 or later. For Windows Server 2019, update to build 10.0.17763.8644 or later. For Windows Server 2022, update to build 10.0.20348.5020 or later. For Windows Server 2025, update to build 10.0.26100.32690 or later. Consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32215 for patch delivery channels and deployment guidance.