Windows Search EUVD-2026-73000

Exploitation requires a valid network account with at least low-privileged access (PR:L) to the target Windows system or domain. User interaction is required (UI:R) - a victim must trigger a Search-related operation to cause the sensitive write to occur. The Windows Search Component (SearchIndexer/SearchHost) must be running, which is the default state on all affected editions. Exploitation is constrained to confidentiality impact only; no write or availability primitive is exposed. Non-default hardening that disables Windows Search indexing or restricts authenticated SMB/network share access would reduce the attack surface.

The CVSS 5.7 score reflects a moderate, bounded risk: network reachable (AV:N), low complexity (AC:L), but requiring a valid account (PR:L) and user interaction (UI:R), with exclusively confidentiality impact (C:H/I:N/A:N). The C:H metric is the most alarming single signal but it is substantially tempered by the UI:R prerequisite - exploitation cannot be fully automated without engineering victim action. No public exploit code exists and the vulnerability is absent from CISA KEV, confirming no observed in-the-wild exploitation at time of analysis. EPSS data is not present in the input; given the authenticated+interaction gating, mass automated exploitation appears unlikely. The primary real-world risk is a lateral-movement scenario where a low-privileged insider or compromised account harvests credentials or sensitive documents surfaced by Search indexing. The broad Windows footprint elevates aggregate exposure even at moderate per-instance severity.

A low-privileged domain user authenticates to a Windows environment hosting the vulnerable Search Component and induces a victim (e.g., another user or a scheduled task) to trigger a Search query or indexing operation. The Search Component writes sensitive indexed content - such as file contents, credentials cached during indexing, or query results - to an externally-reachable directory, which the attacker then reads over the network to harvest privileged information. No public exploit code is available, so this scenario currently requires manual tradecraft.