CVE-2026-45594

What it actually does

CVE-2026-45594 is a local information disclosure vulnerability in the Windows Application Identity AppID subsystem. An attacker who already has valid local access to an affected Windows system can trigger AppID behavior that exposes sensitive information they should not be able to read. The flaw does not directly allow remote code execution, privilege escalation, data modification, or denial of service, but the disclosed information may help an attacker understand system state, security policy, identity context, application control configuration, or other data useful for follow-on attacks.

Why it matters to the business

The practical risk is highest on shared workstations, jump hosts, virtual desktop infrastructure, developer systems, and Windows servers where low-privileged users or compromised accounts may have local logon rights. Because the vulnerability affects many supported Windows client and server versions, exposure can be broad across enterprise fleets. It is not currently listed in CISA KEV, has low EPSS, and has no known public exploit maturity, so it is not an emergency remote-compromise scenario; however, it should still be patched through normal Windows security update cycles because information disclosure flaws are often chained with other vulnerabilities or credential-access techniques.

How an attack unfolds

An attacker first needs local authenticated access to an affected Windows system, such as through a standard user account, compromised endpoint session, malware already running as a user, or authorized-but-malicious insider access. The attacker then runs a tool or script that interacts with the Windows Application Identity subsystem through local APIs, services, policy evaluation paths, or interprocess communication exposed to authenticated users. Due to improper protection of sensitive information, AppID returns or exposes data outside the attacker's intended authorization boundary. The attacker reviews the disclosed information for material that can support later actions, such as identifying application control rules, security policy details, privileged execution contexts, account or path information, or configuration details. The disclosed data may then be combined with other weaknesses to improve privilege escalation, defense evasion, credential discovery, or targeted lateral movement.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Because no exact fixed build or KB is provided in the input, use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or equivalent patch management tooling to identify and deploy the applicable June 2026 or later cumulative security update for each OS release. Prioritize systems that permit interactive or remote local logon by non-administrators, shared administrative hosts, VDI pools, and servers where untrusted users can run code. Where immediate patching is not possible, reduce local logon rights, remove unnecessary standard-user access to servers, enforce least privilege, restrict script and binary execution with application control, monitor for suspicious local enumeration behavior, and ensure AppLocker or Windows Defender Application Control policies are not overly permissive.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft cumulative security update that supersedes the vulnerable AppID component. Use centralized patch reporting from WSUS, Microsoft Configuration Manager, Intune, Defender Vulnerability Management, or vulnerability scanners to verify compliance by OS version and build. On individual systems, validate installed updates using Windows Update history, Get-HotFix, DISM package listings, or system build information, then compare against Microsoft’s security update guidance for this CVE. After patching, confirm the Application Identity service and application control policies continue to operate as expected. Because this is a local information disclosure issue and no public exploit indicators are known, validation should focus on patch presence and reduction of local access exposure rather than attempting exploitation in production.

Typical attack path

1. Obtain local authenticated access to an affected Windows workstation or server.
2. Run a locally executed tool, script, or malware component under a low-privileged user context.
3. Interact with the Windows Application Identity AppID subsystem through legitimate local interfaces or policy evaluation behavior.
4. Trigger the vulnerable information disclosure condition.
5. Collect sensitive information exposed by the subsystem.
6. Use the disclosed information to guide follow-on activity such as privilege escalation research, application-control bypass planning, credential targeting, or lateral movement.

How to detect it

There are no widely documented exploit artifacts, public proof-of-concept indicators, KEV listing, or known threat actor campaigns associated with this vulnerability based on the provided data. Detection should therefore focus on behavioral evidence of local post-compromise activity rather than a single reliable signature. Review Windows Security logs for unusual local or RDP logons by low-privileged accounts, especially followed by system enumeration, application control policy discovery, or execution of unfamiliar binaries or scripts. Review Microsoft-Windows-AppID/Operational, Microsoft-Windows-AppLocker/*, Microsoft-Windows-CodeIntegrity/Operational, and service control logs for unusual AppID-related errors, policy queries, or abnormal service interactions. Endpoint telemetry should be searched for non-administrative processes querying application identity, AppLocker, WDAC, policy, token, SID, or process metadata at scale. Also examine Sysmon or EDR process creation, module load, named pipe, and API telemetry for suspicious local tools executed from user-writable directories. If suspicious activity is found, expand investigation to credential dumping, privilege escalation attempts, new services, scheduled tasks, persistence mechanisms, and lateral movement from the same user or host.

What your security team should do

• Deploy the relevant Microsoft cumulative security updates across affected Windows client and server versions during the next standard security patch cycle, or sooner for shared and high-value systems.
• Prioritize remediation for systems allowing local interactive use by multiple users, RDP access by non-administrators, VDI environments, jump hosts, developer workstations, and servers where untrusted code can execute.
• Review local logon rights, Remote Desktop group membership, and delegated server access to reduce the number of users who can exploit local-only vulnerabilities.
• Harden endpoint execution controls using Microsoft Defender, AppLocker, or Windows Defender Application Control to limit arbitrary local tooling and scripts.
• Monitor for suspicious local enumeration activity involving AppID, application control policy discovery, and unusual process interactions with application identity services.
• Treat any confirmed exploitation as a post-compromise signal and investigate for credential access, privilege escalation attempts, persistence, and lateral movement.
• Track Microsoft Security Update Guide for fixed build and KB details, since exact fixed versions were not supplied in the input.