Windows Event Viewer EUVD-2026-99547

Exploitation requires the attacker to already possess valid low-level authorization (CVSS PR:L) on, or network authentication to, the target - this is not remote unauthenticated access. The attacker then reaches the Windows Event Viewer component over the network (AV:N) with no user interaction and low complexity, abusing improperly scoped file/directory access (CWE-552) to read data outside intended bounds. Limiting factors: the need for pre-existing credentials/authorization sharply reduces exposure on hardened single-admin systems, while multi-user or shared-access hosts (terminal/RDS servers, jump boxes) materially increase realistic risk. Impact is confined to information disclosure; there is no integrity or availability effect.

This is a moderate-severity information disclosure flaw (CVSS 6.5) in the Windows Event Viewer, rooted in CWE-552 (files/directories accessible to external parties, consistent with the 'Path Traversal' tag). The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable attack that is low-complexity and requires no user interaction, but does require pre-existing low-level privileges (PR:L) - so it is not an unauthenticated internet-facing threat. The impact is purely confidentiality (C:H) with no integrity or availability effect, matching the 'disclose information' description. Real-world risk signals are low-to-moderate and mutually consistent: the CISA SSVC framework rates Exploitation as 'none', Automatable 'no', and Technical Impact 'partial', and there is no CISA KEV listing and no POC reported in the input. No EPSS score was provided. In short, this is a genuine but not emergency-grade issue: a credentialed/authorized attacker could read files they should not, but there is no evidence of active exploitation or easy mass-automation. Prioritize via normal Microsoft Patch Tuesday cycles rather than as a drop-everything emergency, weighting higher only in environments where low-privileged network accounts are common (e.g., shared servers, RDS/multi-user hosts).

An attacker who already holds a low-privileged authorized account leverages the Event Viewer flaw over the network to coax the component into exposing files or directories outside its intended scope, reading sensitive data they are not authorized to see. Because attack complexity is low and no user interaction is needed, a single crafted request against a reachable host suffices. No public exploit code was identified at the time of analysis, so this would require original exploit development.