EUVD-2026-44057
GHSA-h28h-fwpm-699x
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local vector confirmed by description; PR:L because a standard authenticated user account is required; C:H reflects sensitive data disclosure; I:N and A:N as no write or disruption impact is present.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
AnalysisAI
Windows File Explorer exposes sensitive information to locally authenticated, low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases. Classified under CWE-200, the flaw allows an authorized local attacker to read data they should not have access to through the File Explorer shell component. No public exploit code has been identified at time of analysis, EPSS sits at 0.36% (28th percentile), and CISA SSVC assesses exploitation as none and not automatable - indicating low urgency despite the high confidentiality impact recorded in the CVSS score.
Technical ContextAI
The vulnerability resides in Windows File Explorer (the Windows shell component, explorer.exe), which is the primary graphical file-management interface across all modern Windows client and server SKUs. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates that the flaw stems from improper access controls or insufficient output filtering within the File Explorer process itself, permitting a low-privileged user to read data - such as file metadata, path information, or content - that should be restricted to higher-privileged contexts. The affected CPE strings span microsoft:windows_10 (versions 1607, 1809, 21H2, 22H2), microsoft:windows_11 (versions 24H2, 25H2, 26H1), and microsoft:windows_server editions (2016, 2016 Server Core, 2019), with additional coverage noted in tags for Windows Server 2022 and 2025. The attack vector is strictly local (AV:L), ruling out remote network-based triggering of the flaw.
RemediationAI
The primary remediation is to apply the Microsoft-released patch via Windows Update or WSUS, targeting the fixed build thresholds documented in the EUVD record: Windows 10 21H2/22H2 systems should reach 10.0.19044.7548 or 10.0.19045.7548 respectively, Windows 11 24H2 should reach 10.0.26100.8875, Windows Server 2025 should reach 10.0.26100.33158, and Windows Server 2022 should reach 10.0.20348.5386 - with corresponding build thresholds for all other affected SKUs as listed above. The vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50473 provides the canonical patch reference. If patching is temporarily not feasible, restricting local logon access to only trusted accounts limits exposure, since exploitation requires PR:L (an authenticated local session). On Windows Server deployments running Server Core installations, the attack surface from File Explorer is reduced given the headless nature of those configurations, though the CPE data confirms they remain listed as affected. No effective workaround short of patch application has been identified that addresses the root cause.
More in Windows Server 2016
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today