Windows File Explorer EUVD-2026-44060

Exploitation requires a locally authenticated session with at least standard user (low) privileges on the affected Windows system - confirmed by CVSS AV:L/PR:L. The description explicitly states 'an authorized attacker,' meaning the threat actor must already possess a legitimate account with interactive logon capability. No network access is required, no elevated administrative privileges are needed, no user interaction from a second user is required, and no non-default configuration is specified as a prerequisite. What limits exploitation: the mandatory local authentication (PR:L) eliminates all remote unauthenticated attack paths; the unchanged scope (S:U) prevents lateral movement or escape from the Explorer security boundary via this vulnerability alone; and impact is strictly confidentiality-only (I:N/A:N), ruling out destructive outcomes or privilege escalation. The highest-risk deployment contexts are multi-user environments - Remote Desktop Services hosts, terminal servers, shared kiosks, and VDI environments - where untrusted local users are a routine attacker profile.

The CVSS 3.1 base score of 5.5 (Medium) accurately reflects a constrained but genuine risk: AV:L limits exploitation to actors with existing local access, AC:L indicates no special configuration or timing is required once access is obtained, and PR:L means a standard user account suffices. The high confidentiality impact (C:H) is notable - whatever data is exposed is fully readable, not merely partially leaked. No EPSS score was provided in the input data, which is a gap that prevents probabilistic exploitation assessment. There is no CISA KEV listing and no known public proof-of-concept, leaving exploitation probability unquantified. The absence of integrity and availability impact (I:N/A:N) and unchanged scope prevent this from being a pivot or escalation primitive on its own. The greatest operational risk is in multi-user deployments - RDS/terminal servers, shared kiosk environments, VDI farms - where untrusted local accounts are routinely provisioned and the attacker profile (local authenticated user) is common. Single-user workstations with controlled physical access are materially lower risk. CVSS and real-world risk signals are broadly consistent; no conflicting data was identified in available intelligence.

A standard domain user with an active interactive session on a shared Windows terminal server navigates within File Explorer in a way that inadvertently surfaces sensitive file metadata, paths, or content belonging to other users or privileged accounts - for example, through a shared thumbnail cache or improperly scoped shell data structure. The attacker requires no special tooling, no network position, and no elevated credentials; a normal Windows logon and File Explorer interaction suffice. No public proof-of-concept has been identified at time of analysis, but the low attack complexity (AC:L) in the CVSS vector indicates the exposure mechanism, once identified, would require minimal technical sophistication to trigger.