CVE-2026-42907

What it actually does

This is an information disclosure vulnerability in Windows Shell affecting multiple Windows 10, Windows 11, and Windows Server releases. An attacker with valid low-privileged access can trigger Shell behavior that exposes sensitive information they should not be able to read. The primary impact is confidentiality loss; the CVSS vector indicates no direct integrity or availability impact. Because the vector is network-accessible with low privileges and no user interaction, the flaw may be reachable through authenticated sessions or remote management contexts where Windows Shell components are invoked.

Why it matters to the business

Successful exploitation could expose sensitive local or user-context information from affected Windows workstations or servers, potentially helping an attacker expand access, identify high-value data, or support follow-on attacks. The issue is not currently listed in CISA KEV, has no known public exploit maturity, and has a low, stable EPSS score, so it is not currently showing strong evidence of broad exploitation. However, the affected product set is broad across supported Windows desktop and server versions, so enterprises should treat remediation as part of normal priority patching, especially on multi-user systems, jump hosts, remote desktop servers, and administrative workstations.

How an attack unfolds

An attacker first obtains valid low-privileged access to an affected Windows system or an authenticated path that can interact with vulnerable Windows Shell functionality. They then invoke the vulnerable Shell behavior in a way that causes information to be returned or exposed outside the intended authorization boundary. The disclosed data may include information useful for reconnaissance or privilege escalation planning, depending on the local system state and user context. The attacker can then use the exposed information to refine subsequent activity, such as targeting specific users, files, processes, credentials, configuration paths, or administrative workflows. There is no indication from the provided intelligence that exploitation is currently automated in public tooling or actively used by named threat actors.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-42907 for all affected Windows versions, including Windows 10 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, and 26H1; Windows Server 2019; Windows Server 2022; and Windows Server 2025. No exact fixed build or package versions were provided in the input, so organizations should use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or their endpoint management platform to deploy the latest cumulative update applicable to each supported OS version. Prioritize systems that allow multiple interactive users, Remote Desktop Services hosts, administrator workstations, jump servers, and internet-reachable systems that expose authenticated Windows management surfaces. Where immediate patching is not possible, reduce exposure by limiting interactive logon rights, restricting RDP and remote management access, enforcing least privilege, disabling unnecessary Shell extensions or remote desktop use cases where feasible, and monitoring low-privileged users accessing unusual local resources.

How to confirm the fix worked

Confirm each affected system has installed the Microsoft cumulative update that includes the fix for this vulnerability. Validate through Windows Update history, enterprise patch management compliance reports, PowerShell inventory of installed hotfixes, or endpoint vulnerability scanning. Compare OS build numbers and installed cumulative updates against Microsoft’s security update guidance for the June 2026 release or later applicable updates. For exposure validation, inventory all affected Windows 10, Windows 11, and Windows Server versions and identify devices missing the relevant cumulative update. Where vulnerability scanners are used, ensure plugin content is current and scan both workstations and servers. If compensating controls are applied, confirm that low-privileged users cannot interactively log on to sensitive servers and that remote access paths such as RDP and Windows remote management are restricted to approved administrative groups and networks.

Typical attack path

1. Obtain valid low-privileged access to an affected Windows workstation or server.
2. Identify whether the target runs an affected Windows version such as Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025.
3. Invoke the vulnerable Windows Shell functionality from the available user or remote session context.
4. Cause sensitive information to be disclosed outside the intended authorization boundary.
5. Use the disclosed information for reconnaissance, lateral movement preparation, credential targeting, or other follow-on activity.

How to detect it

There are no unique public exploit indicators provided for this vulnerability, so detection should focus on behavioral evidence of suspicious post-authentication information discovery and unauthorized local access. Review Windows Security logs for unusual low-privileged logons, especially interactive, remote interactive, or network logons to systems where the user does not normally operate. Correlate those events with process creation telemetry from Microsoft Defender for Endpoint, Sysmon, EDR, or Windows Event ID 4688 for Shell-related activity such as explorer.exe spawning command shells, scripting engines, archive tools, or reconnaissance commands. Examine PowerShell logs, command-line auditing, and EDR timelines for users enumerating files, user profiles, mounted drives, credentials, browser data, recent files, shortcut metadata, shell folders, or administrative shares. On RDP or shared systems, review TerminalServices logs for unexpected sessions and session reconnections. Since this is an information disclosure issue, successful exploitation may leave no crash or explicit exploit log; prioritize correlation of anomalous low-privileged access with subsequent discovery, credential targeting, lateral movement attempts, or access to sensitive paths. No named threat actors, ransomware campaigns, or public exploit artifacts were provided, so detections should be behavior-based rather than IOC-based.

What your security team should do

• Inventory all affected Windows desktop and server versions and identify systems missing the applicable Microsoft cumulative update.
• Patch high-risk systems first, especially Remote Desktop Services hosts, jump servers, administrator workstations, shared workstations, and servers with broad user logon rights.
• Use endpoint management or vulnerability scanning to verify update deployment and report exceptions.
• Review local and domain logon rights to ensure low-privileged users cannot access sensitive servers unnecessarily.
• Restrict RDP, SMB administration, WinRM, and other authenticated remote access paths to trusted networks and approved administrative groups.
• Monitor for unusual activity by low-privileged users on patched and unpatched systems, especially access to Shell-related processes, sensitive directories, and reconnaissance commands.
• Because KEV status is false, EPSS is low and stable, and exploit maturity is listed as none, handle this through risk-based patch management rather than emergency response unless internal exposure is high.