EUVD-2026-44058
GHSA-g3h6-h639-h7qp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access with a low-privilege authenticated session is required; no user interaction needed; only confidentiality is impacted with no integrity or availability effects.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
AnalysisAI
Windows File Explorer across all major Windows 10, Windows 11, and Windows Server releases exposes sensitive information to local authenticated users via a CWE-200 information disclosure flaw. An authorized attacker with low-privilege local access can read data they should not be permitted to access without any user interaction. No public exploit code has been identified at time of analysis and CISA SSVC confirms no observed exploitation, placing this squarely in routine patch-cycle priority despite the broad footprint of affected systems.
Technical ContextAI
The vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a class of flaws where a software component inadvertently makes data accessible beyond its intended authorization boundary. Windows File Explorer (explorer.exe) is the default shell and file management interface shipped with all Windows desktop and server editions, making it a universally present attack surface. Affected CPE strings span microsoft:windows_10_version_1607 through microsoft:windows_server_2019 per NVD, with EUVD-2026-44058 extending confirmed coverage to Windows Server 2022, Windows Server 2025, Windows 11 24H2, 25H2, and 26H1. The local attack vector (AV:L per CVSS) indicates the flaw is triggered within an existing authenticated session, suggesting File Explorer is improperly surfacing restricted data-potentially file metadata, path information, or content from protected system locations-in a manner visible to a standard local user.
RemediationAI
Apply the vendor-released patch through Windows Update or the Microsoft Update Catalog as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50442. Target patched build numbers are: 10.0.14393.9339 for Windows 10 Version 1607 and Windows Server 2016; 10.0.17763.9020 for Windows 10 Version 1809 and Windows Server 2019; 10.0.19044.7548 for Windows 10 Version 21H2; 10.0.19045.7548 for Windows 10 Version 22H2; 10.0.20348.5386 for Windows Server 2022; 10.0.26100.8875 for Windows 11 Version 24H2; 10.0.26100.33158 for Windows Server 2025 and its Server Core variant; 10.0.26200.8875 for Windows 11 Version 25H2; and 10.0.28000.2269 for Windows 11 Version 26H1. No Microsoft-disclosed workaround to disable the vulnerable File Explorer code path without patching is available in the referenced data. If patching is delayed, restricting interactive local logon rights (via Local Security Policy or Group Policy) to only operationally necessary personnel reduces the attacker population, though this is a defense-in-depth measure and does not eliminate the flaw.
More in Windows Server 2016
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today