EUVD-2026-44060
GHSA-62wj-96fg-2fpq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local interactive access with standard user privileges confirmed by description; high confidentiality impact only, no integrity or availability effect, unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
AnalysisAI
Windows File Explorer on a wide range of Microsoft Windows client and server versions exposes sensitive information to locally authenticated standard users, achieving high confidentiality impact without requiring elevated privileges. The flaw (CWE-200) is confined to the local attack surface - CVSS AV:L/PR:L - meaning the attacker must already hold an interactive session on the target system. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor patch is available through Microsoft Security Response Center.
Technical ContextAI
Windows File Explorer (explorer.exe) is the integrated shell and file management component shipped with all Windows client and server editions. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) covers scenarios where an application fails to properly restrict access to data - common manifestations in File Explorer include improper access controls over MRU (most recently used) lists, thumbnail caches, named pipe communications, or shell metadata structures that may reference or expose content belonging to other users or elevated processes. The CVSS unchanged scope (S:U) confirms the exposure does not escape the security boundary of the Explorer component itself. CPE data confirms the flaw spans the Microsoft Windows product line from Windows Server 2012 through Windows 11 Version 26H1, indicating a long-standing architectural pattern rather than a regression introduced in a single release.
RemediationAI
The primary remediation is to apply the vendor-released patch documented in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50456. The exact KB article number and patched build version are not confirmed in the provided input data and should be retrieved directly from the MSRC advisory, which lists per-version update packages. As an interim compensating control where immediate patching is not possible, restricting interactive logon rights on sensitive systems (via Group Policy: 'Allow log on locally') limits the pool of users who could exploit the local attack vector; however, this does not remediate the underlying flaw and has operational trade-offs for service accounts and remote desktop users. In multi-user environments such as RDS or terminal servers, enforcing strict file system ACLs on sensitive data directories reduces the scope of information potentially exposed through the Explorer flaw. Prioritize patching on shared-access systems, where the local-user attacker model is most realistic.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today