Windows NTFS EUVD-2026-99393

Exploitation requires the attacker to already have authenticated, low-privileged local access to the target Windows system (CVSS PR:L, AV:L) - there is no remote or network-facing attack path. No user interaction is required (UI:N), but the local-access prerequisite is the key limiting factor: the attacker needs an existing foothold such as a standard user account or low-integrity code execution. Impact is confined to information disclosure via NTFS (C:H, with I:N/A:N), so it cannot by itself modify data or crash the system. Affected systems are those running NTFS builds below the patched versions listed in the EUVD advisory (e.g., Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650); patched builds are not exploitable.

This is a genuinely moderate-priority, not a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-exploitable information-disclosure flaw requiring the attacker to already hold low-level authenticated access to the host; there is no network reach, no integrity or availability impact, and no scope change. All exploitation signals point the same direction and are consistent: CISA's SSVC decision framework records Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', and there is no CISA KEV listing and no public exploit identified at time of analysis. EPSS score was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The one point worth flagging is a taxonomy mismatch rather than a risk conflict: the CWE is CWE-290 (Authentication Bypass by Spoofing) and the tag says 'Authentication Bypass', yet the description characterizes the issue as improper access control leading to local information disclosure - verify the exact mechanism with Microsoft's MSRC advisory, as the high confidentiality impact (C:H) is the real driver of the 5.5 score. Net: a patch-in-normal-cycle local info-disclosure bug, most relevant as a post-compromise privilege/secrecy-boundary weakness, not a remotely wormable priority.

An attacker who has already obtained low-privileged authenticated access to a Windows host (e.g., a standard local or domain user, or code running in a low-integrity context) abuses the improper access control in NTFS to read file data or metadata they should not be able to see. No user interaction and no elevated privileges are required beyond that initial foothold, but because the attack vector is local (AV:L), it cannot be launched remotely. No public exploit code has been identified at time of analysis.