Windows Shell EUVD-2026-99431

Exploitation requires the victim to actively interact with attacker-supplied content (CVSS UI:R) - such as opening a crafted file, link, or Shell-handled resource delivered over the network - meaning there is no fully automatic or passive exploitation path. The flaw lies in Windows Shell's incorrectly implemented authentication algorithm (CWE-303), so exploitation depends on the victim's system processing content through the affected Shell authentication routine on an unpatched build within the listed version ranges (e.g., Windows 11 24H2 before 10.0.26100.9711, Windows Server 2025 before 10.0.26100.33650). The primary limiting factors are the mandatory user interaction and the spoofing-only nature of the impact (no code execution, integrity, or availability loss per C:H/I:N/A:N); the practical requirement is social-engineering the user rather than any special target-side configuration.

This is a moderate-severity (CVSS 6.5) spoofing vulnerability in Windows Shell arising from an incorrectly implemented authentication algorithm (CWE-303). The signals point consistently toward LOW real-world urgency despite the network attack vector: the CVSS vector (AV:N/AC:L/PR:N/UI:R) shows a network, low-complexity, unauthenticated vector, but critically requires user interaction (UI:R), and CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial' - all three indicating this is not a high-priority, mass-exploitable issue. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit identified, so this is not confirmed as actively exploited. One internal inconsistency warrants attention: the description characterizes the flaw as 'spoofing' (which typically maps to an integrity impact) yet the Microsoft-assigned CVSS vector sets C:H/I:N/A:N (high confidentiality, no integrity impact) - this confidentiality-only spoofing rating is unusual and should be verified against the Microsoft MSRC advisory. Net assessment: a credible but non-urgent patch-cycle item, not an emergency, because it requires tricking a user into interaction and shows no automatability or active exploitation.

An unauthenticated attacker crafts a malicious resource (e.g., a file, link, or network response handled by Windows Shell) and lures a victim into interacting with it. Because the authentication algorithm is incorrectly implemented, the content is presented as originating from a trusted source, enabling a spoofing deception that could expose sensitive information. No public exploit code has been identified at time of analysis.