CVE-2026-41087

What it actually does

This vulnerability is a local information disclosure flaw in Windows File Explorer. A locally authenticated attacker with low privileges can cause File Explorer to expose sensitive information that should not be accessible to that user. The CVSS vector indicates local access is required, exploitation complexity is low, no user interaction is required, and the primary impact is high confidentiality loss with no direct integrity or availability impact.

Why it matters to the business

If exploited, this flaw could allow a user or malware already running on a Windows workstation or server to obtain sensitive local information, potentially including data that helps with reconnaissance, credential discovery, privacy exposure, or follow-on compromise. Because exploitation requires local access and there is no known public exploit or CISA KEV listing, the near-term mass exploitation risk appears low, but affected Windows desktop and server versions are widely deployed, so patching should be included in normal security update cycles and prioritized on shared systems, administrator workstations, jump servers, and multi-user servers.

How an attack unfolds

An attacker first obtains the ability to run code or commands as a low-privileged local user on an affected Windows system. They then interact with Windows File Explorer or components it invokes in a way that triggers the vulnerable information disclosure behavior. If successful, information that should be restricted from that user is exposed locally. The disclosed information may then be used to support additional activity, such as identifying sensitive files, learning system configuration details, targeting privileged users, or improving the effectiveness of later privilege escalation or lateral movement attempts. There is currently no indication from the provided data that this vulnerability is being exploited in the wild, used by ransomware campaigns, or associated with named threat actors.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows versions: Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; Windows Server 2016, 2019, 2022, and 2025. No exact fixed build numbers were provided, so use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or the Microsoft Update Catalog to deploy the security update that addresses CVE-2026-41087 for each supported operating system version. Where immediate patching is not possible, reduce exposure by limiting interactive logon rights, restricting local user access to shared servers, hardening administrator workstations, monitoring unusual local enumeration activity, and ensuring endpoint protection is active. Mitigations should not be treated as a substitute for applying the vendor fix.

How to confirm the fix worked

Confirm that each affected system has installed the Microsoft security update released for this vulnerability and that the OS build is at or above the patched level for its Windows version. Validate through centralized patch management reporting, Windows Update history, installed hotfix inventory, vulnerability scanning, or authenticated configuration assessment. On representative systems, verify the machine is no longer reported as vulnerable by an authenticated scanner with current Microsoft vulnerability checks. For servers and shared endpoints, also confirm that unnecessary local interactive access has been removed and that endpoint telemetry is being collected for File Explorer and local process activity.

Typical attack path

1. Gain local authenticated access to an affected Windows workstation or server as a standard user.
2. Execute or interact with Windows File Explorer functionality that reaches the vulnerable code path.
3. Trigger the information disclosure condition without requiring additional user interaction.
4. Collect exposed sensitive information from the local system context.
5. Use the disclosed information for reconnaissance, credential hunting, privacy compromise, or to assist later attacks.

How to detect it

There are no uniquely reliable public indicators in the supplied data that prove exploitation of this vulnerability, and successful exploitation may resemble normal local File Explorer activity. To investigate possible prior abuse, review endpoint detection and response telemetry, Windows Security logs, Sysmon logs, PowerShell logs, and file access auditing where enabled. Focus on activity from low-privileged users on affected systems shortly before suspicious access to sensitive information, credential stores, profile directories, administrative shares, or configuration files. Look for unusual explorer.exe child processes, scripted or command-line enumeration launched near File Explorer activity, abnormal reads of sensitive local paths, and follow-on reconnaissance commands such as whoami, net user, net localgroup, dir, icacls, findstr, or PowerShell file searches. Treat findings as behavioral leads rather than definitive proof unless correlated with a known exploit artifact or confirmed vulnerable-system reproduction.

What your security team should do

• Deploy the Microsoft security update for affected Windows client and server versions through the normal monthly patch process.
• Prioritize shared Windows servers, virtual desktop infrastructure, kiosk systems, jump boxes, administrator workstations, and systems used by multiple local users.
• Use authenticated vulnerability scanning or endpoint management inventory to identify remaining Windows 10, Windows 11, and Windows Server systems missing the relevant update.
• Review local user and interactive logon permissions on sensitive systems to reduce opportunities for local information disclosure abuse.
• Monitor endpoint telemetry for suspicious local reconnaissance activity involving explorer.exe, command shells, scripting tools, credential-search behavior, and unusual access to sensitive directories.
• Because EPSS is low, flat over 30 days, and there is no KEV listing or known exploit maturity in the supplied data, handle as important routine patching rather than emergency internet-wide incident response unless local threat conditions dictate otherwise.