CVE-2026-20834

Medium · 4.6

CVSS

4.6

EPSS

0.7%

Published

Jan 13, 2026

CISA due date

—

The record

Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack.

Ecosystem	Package	Introduced	Fixed