Windows Shell EUVD-2026-35596

The CVSS vector PR:L confirms a low-privilege authenticated account is required - unauthenticated exploitation is not supported. UI:N means no victim interaction is needed beyond the attacker's own actions. The description states the disclosure occurs 'locally,' which limits exploitation to users with local or interactive session access to the affected system, though this conflicts with the AV:N network vector - if the local scope is accurate, exploitation requires an existing foothold on the target host (e.g., via RDP, console, or prior compromise). AC:L indicates no special race condition or complex setup is required once access is obtained. No specific non-default configuration trigger or feature flag is identified in the available data. The scope is unchanged (S:U), meaning exploitation is contained to the vulnerable component and does not allow cross-privilege-boundary escalation on its own.

The CVSS base score of 6.5 (Medium) reflects high confidentiality impact but constrained scope (S:U) and no integrity or availability impact. The PR:L requirement confirms authentication is needed - unauthenticated exploitation is not supported by the CVSS vector. A critical data conflict exists: the CVSS attack vector is AV:N (network-exploitable) while the description states exploitation occurs 'locally' - if the actual attack vector is local (AV:L), the real-world exploitability is substantially more restricted than the CVSS vector implies, and the score may be inflated. EPSS data was not provided, limiting probabilistic exploitation forecasting. No KEV listing and no public exploit code have been identified, indicating no confirmed active exploitation at time of analysis. For organizations with shared Windows environments, multi-tenant RDS/VDI deployments, or attacker-controlled low-privilege accounts, the high confidentiality impact still warrants prompt patching, particularly given low attack complexity (AC:L) once access is obtained.

An authenticated attacker with low-privilege access to a Windows system - such as a domain user on a shared workstation or RDS session host - leverages the Windows Shell vulnerability to read sensitive information they are not authorized to access, potentially including credentials, file paths, environment variables, or security tokens. No public exploit code has been identified at time of analysis, so exploitation likely requires manual technique development. If the AV:N vector is accurate, a remote low-privilege attacker could trigger this over the network without requiring physical or interactive local access.