Executive brief
A security vulnerability in Windows File Explorer could allow a person with existing access to a computer to view sensitive information they are not authorized to see. File Explorer is the standard tool used for browsing files and folders on Windows systems. While this flaw does not allow remote access, it could lead to the exposure of private data or system details to unauthorized local users. Microsoft has released security updates to address this issue across various versions of Windows and Windows Server.
Technical details
An information disclosure vulnerability exists in Windows File Explorer (CWE-200). The flaw allows an authenticated attacker with local access to the system to bypass intended access restrictions and view sensitive information. The vulnerability is triggered locally and does not require user interaction beyond the attacker's own actions. Microsoft has classified this as Medium severity with a CVSS score of 5.5, primarily impacting confidentiality. Security updates are available for affected versions of Windows 10, Windows 11, and Windows Server.
Affected products
- Microsoft Windows 10 Version 1607 10.0.14393.0 to 10.0.14393.9339
- Microsoft Windows 10 Version 1809 10.0.17763.0 to 10.0.17763.9020
- Microsoft Windows 10 Version 21H2 10.0.19044.0 to 10.0.19044.7548
- Microsoft Windows 10 Version 22H2 10.0.19045.0 to 10.0.19045.7548
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8875
- Microsoft Windows Server 2016 10.0.14393.0 to 10.0.14393.9339
Timeline
- 2026-07-14: disclosed: Initial publication by Microsoft and NVD
- 2026-07-14: patched: Security updates released by Microsoft