What is the CVSS score of EUVD-2026-22601?

EUVD-2026-22601 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-22601?

Yes, a patch is available for EUVD-2026-22601. Update the affected software to the latest version immediately.

Microsoft EUVD-2026-22601

| CVE-2026-32217 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-04-14 microsoft

GHSA-454m-v4gh-w6c2

Information Disclosure Microsoft

5.5

CVSS 3.1 · NVD

Temporal: 4.8

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

4.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 19:41 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22601

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

MEDIUM 5.5

DescriptionCVE.org

Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.

AnalysisAI

Windows Kernel logs sensitive information that can be read by local authenticated users, allowing information disclosure on Windows 10 and Windows 11 systems across multiple versions as well as Windows Server 2012 through 2025. The vulnerability requires local access and valid user credentials (privilege level L) but results in high confidentiality impact. Microsoft has released patches for all affected versions.

Technical ContextAI

This vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File), a weakness in the Windows Kernel's logging mechanisms. The kernel inadvertently writes sensitive data to log files that are accessible by authenticated local users with standard privileges. Unlike many kernel vulnerabilities that require escalation or bypass of security boundaries, this flaw exposes data through a design issue in what information is logged and who can read those logs. The affected systems span Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server editions (2012 through 2025), indicating the issue is systemic across multiple kernel versions.

RemediationAI

Patch available from Microsoft via the official update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32217. Apply the cumulative security updates specified for your Windows version as indicated in the EUVD affected versions list; for example, Windows 10 Version 22H2 requires update to build 10.0.19045.7184 or later, Windows 11 Version 24H2 requires build 10.0.26100.32690 or later, and Windows Server 2022 requires build 10.0.20348.5020 or later. Organizations unable to patch immediately should restrict local user access to systems containing sensitive data and review kernel log file permissions to ensure only authorized administrators can read them. Deployment through Windows Update or WSUS is the standard remediation path for Windows client and server systems.