CVE-2026-32079

What it actually does

CVE-2026-32079 is a local information disclosure vulnerability in Windows File Explorer. An attacker who already has valid local access to an affected Windows system can cause File Explorer to expose sensitive information that should not be available to that user. The vulnerability affects confidentiality only; it does not directly provide code execution, privilege escalation, data modification, or denial of service. However, any disclosed information could potentially support follow-on activity such as credential discovery, reconnaissance, lateral movement, or targeting of higher-value data.

Why it matters to the business

The main business risk is unauthorized exposure of sensitive local information from Windows workstations or servers. Because exploitation requires an attacker to already have local authenticated access, this is most concerning on shared workstations, multi-user servers, jump hosts, developer systems, administrative workstations, and environments where standard users have interactive access. The CVSS score is moderate, EPSS is low and stable, there is no known CISA KEV listing, no known ransomware association, and no public exploit maturity reported, so this should be prioritized as part of normal Windows patching rather than treated as an emergency unless affected systems process highly sensitive data.

How an attack unfolds

An attacker first obtains valid local access to an affected Windows system, such as through a standard user account, interactive logon, remote desktop access, or prior compromise. The attacker then interacts with Windows File Explorer in a way that triggers the information disclosure condition. If successful, File Explorer reveals sensitive information that the attacker should not be able to access under normal authorization boundaries. The attacker can then use the disclosed information for local reconnaissance, to identify valuable files or users, to support credential or token targeting, or to plan additional attacks. This vulnerability is not expected to be remotely exploitable by itself and does not by itself grant administrative privileges.

How to fix it

Apply the Microsoft security update that addresses this vulnerability through Windows Update, Microsoft Update Catalog, WSUS, Microsoft Configuration Manager, Intune, or another enterprise patching platform. Prioritize affected Windows client and server versions listed as impacted: Windows 10 1607, 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H1; Windows Server 2016, 2019, 2022, 2022 23H2, and 2025. If immediate patching is not possible, reduce risk by limiting interactive logon rights, restricting RDP access, removing unnecessary local accounts, enforcing least privilege, isolating shared systems, and avoiding use of affected systems for sensitive administrative workflows until patched. No exact fixed build numbers were provided in the input, so organizations should rely on Microsoft’s official advisory, cumulative update metadata, and patch compliance tooling to identify the applicable fixed release for each supported Windows version.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows endpoint has installed the Microsoft cumulative/security update that includes the fix for CVE-2026-32079. Use centralized patch compliance reporting from WSUS, Microsoft Configuration Manager, Intune, Defender Vulnerability Management, or equivalent endpoint management tooling. On individual systems, review Windows Update history, installed hotfixes, and OS build information using supported administrative tools such as Settings, Control Panel update history, wmic qfe, Get-HotFix, or systeminfo. Vulnerability scanners should no longer report the system as affected after the correct update is installed and the system has been rebooted if required. Also validate that unnecessary local interactive access and remote desktop access are restricted for systems that cannot be patched immediately.

Typical attack path

1. Obtain valid low-privileged local access to an affected Windows workstation or server.
2. Open or invoke Windows File Explorer in the local user context.
3. Trigger the vulnerable File Explorer behavior that exposes restricted or sensitive information.
4. Review the disclosed information for useful system, user, file, credential, or configuration details.
5. Use the gathered information to support follow-on activity such as privilege escalation attempts, lateral movement, or targeted data access.

How to detect it

There are no known public exploit indicators, no reported threat actors, and no unique grep-able artifacts provided for this vulnerability. Because this is a local Windows File Explorer information disclosure issue, successful exploitation may not produce a distinctive log event. Detection should focus on surrounding behavior: review Windows Security logs for unusual local or remote interactive logons, especially Event ID 4624 logon types 2, 10, and 11; failed access attempts or account probing events such as 4625; special privilege assignment events such as 4672; process creation telemetry for explorer.exe launched in unusual user contexts; and endpoint detection telemetry showing interactive exploration of sensitive directories by accounts that do not normally access them. On servers, investigate unexpected explorer.exe execution, because File Explorer activity is less common on many server workloads. Correlate suspicious local logons with file access auditing, EDR file-read telemetry, shell activity, credential discovery behavior, and subsequent lateral movement attempts. Absence of these events does not prove the vulnerability was not exploited; it only indicates that no corroborating suspicious activity was observed.

What your security team should do

• Patch affected Windows clients and servers during the next regular security update cycle, with higher priority for shared systems, administrative workstations, servers with interactive logon enabled, and devices handling sensitive data.
• Use endpoint management or vulnerability management tooling to identify all affected Windows 10, Windows 11, and Windows Server versions and track remediation to completion.
• Restrict local and remote interactive logon rights to only users who require them, especially on servers and administrative workstations.
• Review RDP exposure and privileged access paths to reduce the likelihood that a low-privileged attacker can obtain local access where this flaw is exploitable.
• Monitor for unusual local logons, RDP sessions, and File Explorer activity by non-administrative users on sensitive systems, recognizing that exploitation may not leave a unique artifact.
• Keep this vulnerability in normal patch-priority queues unless new exploit maturity, KEV status, or threat actor activity emerges.