CVE-2026-40422

What it actually does

This is a local information disclosure vulnerability in Windows File Explorer caused by use of an uninitialized resource. An authenticated local attacker can trigger the vulnerable Explorer code path and cause data that should not be exposed to be returned or made observable. The CVSS vector indicates local access is required, low attack complexity, low privileges are sufficient, and no user interaction is required, with impact limited to confidentiality rather than integrity or availability.

Why it matters to the business

Successful exploitation could allow a low-privileged user or malware already running on a Windows workstation or server to obtain sensitive information from the local system. This may help an attacker escalate a broader intrusion by discovering file paths, configuration details, memory-derived data, user activity, or other information useful for follow-on attacks. The current EPSS is low and stable, it is not listed in CISA KEV, and no mature public exploit is indicated, so urgency is moderate, but remediation should still be included in normal Windows patch cycles across affected Windows 10, Windows 11, and Windows Server versions.

How an attack unfolds

An attacker must first have the ability to execute code or interact locally as an authenticated user on an affected Windows system. They then invoke Windows File Explorer functionality that reaches the vulnerable code path involving an uninitialized resource. Because the resource is not properly initialized before use, Explorer may expose information that should have remained inaccessible to that user. The attacker collects the disclosed information and uses it to support additional activity, such as reconnaissance, credential hunting, targeting privileged users, or improving the reliability of a separate exploit chain. This vulnerability by itself does not provide remote code execution, privilege escalation, persistence, or system disruption.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-40422 on all affected Windows versions, including Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; Windows Server 2016, 2019, 2022, and 2025. Because no fixed version list was provided, use the latest cumulative update available for each supported Windows release from Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or an equivalent enterprise patching platform. Prioritize systems with multiple local users, shared workstations, remote desktop servers, jump hosts, administrative workstations, and servers where low-privileged users can log on. If immediate patching is not possible, reduce local interactive access, remove unnecessary standard-user accounts, restrict remote desktop access, enforce application control, and monitor for unusual local execution involving Explorer and scripting tools.

How to confirm the fix worked

Confirm that each affected Windows asset has installed the Microsoft cumulative security update that includes the fix for this vulnerability. Validate through centralized patch management reports, Windows Update history, endpoint management inventory, or PowerShell queries such as reviewing installed hotfixes and OS build numbers against Microsoft’s official release notes. For exposure validation, identify systems running affected Windows versions that have not received the relevant July 2026 or later cumulative security update. Where feasible, perform validation in a test environment by confirming the vulnerable behavior is no longer reproducible after patching, without attempting to extract or retain sensitive data.

Typical attack path

1. Obtain local authenticated access to an affected Windows workstation or server.
2. Run a crafted local action, script, or tool that exercises the vulnerable Windows File Explorer behavior.
3. Trigger use of the uninitialized resource and capture the resulting disclosed information.
4. Analyze the disclosed data for sensitive paths, user context, configuration details, or other useful artifacts.
5. Use the information to support lateral movement, credential access, privilege escalation attempts, or additional exploitation.

How to detect it

There are no reliable public, CVE-specific exploitation indicators for this local information disclosure issue, and exploitation may leave few or no unique artifacts. To assess possible prior exploitation, review endpoint detection telemetry, Windows Security logs, Sysmon logs, PowerShell logs, and application control logs for suspicious local activity by low-privileged users around explorer.exe. Focus on unusual chains where explorer.exe is followed by command shells, scripting interpreters, custom binaries, archive tools, credential discovery tools, or broad file enumeration. Useful Windows event sources include Security process creation auditing, Sysmon Event ID 1 for process creation, Sysmon Event ID 11 for file creation, PowerShell Operational logs, Defender for Endpoint advanced hunting telemetry, and EDR file/process timeline data. Investigations should look for evidence of local reconnaissance, unexpected data collection, access to sensitive user or system paths, and subsequent lateral movement or credential access rather than a single definitive exploit signature.

What your security team should do

• Inventory affected Windows 10, Windows 11, and Windows Server systems and map them to patch status.
• Deploy the applicable Microsoft cumulative security updates through the normal patching process, prioritizing shared systems, servers allowing local or RDP logon, and privileged access workstations.
• Review and reduce local logon rights for non-administrative users on servers and sensitive workstations.
• Monitor for unusual local process activity involving explorer.exe, PowerShell, command shells, scripting engines, or unknown binaries executed by standard users.
• Use endpoint detection and response telemetry to investigate suspicious local reconnaissance, credential discovery, or file system enumeration following Explorer activity.
• Because the vulnerability is not currently KEV-listed and EPSS remains low and flat, handle as a standard-priority patch unless compensating business factors increase exposure.