CVE-2026-57097

What it actually does

This vulnerability is an untrusted search path issue in Microsoft XML on supported Windows client and server versions. If an attacker can physically access the system and satisfy the high-complexity conditions, they may place attacker-controlled files in a location that Microsoft XML searches before the trusted system location. When the vulnerable component is invoked, Windows may load or use the attacker-controlled file instead of the legitimate one, allowing bypass of an intended security boundary and potentially affecting confidentiality, integrity, and availability on the local system.

Why it matters to the business

The practical risk is highest for shared workstations, kiosks, lab systems, point-of-sale devices, servers with console access, and devices exposed to contractors or other people with physical access. Successful exploitation could allow tampering with a Windows system, access to sensitive local data, or disruption of normal operation. The vulnerability is not currently listed in CISA KEV, has low EPSS, and has no reported exploit maturity, so broad internet-scale exploitation is unlikely; however, physical-access scenarios can still matter in regulated, high-trust, or operational environments.

How an attack unfolds

An attacker first obtains physical access to a vulnerable Windows device or to removable/local storage that the device will use. They prepare a malicious file intended to be found through Microsoft XML's vulnerable search behavior, then place it in a directory that is searched before the legitimate trusted location. When the vulnerable XML functionality is triggered, the system may resolve the file from the attacker-controlled location. If the malicious file is loaded or used, the attacker can bypass the affected security feature and potentially execute code or influence system behavior in the context of the invoking process. Because the attack requires physical access and high-complexity setup, exploitation is more likely to be targeted than opportunistic.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-57097 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Where immediate patching is not possible, reduce physical attack opportunities: restrict console access, lock down kiosk and shared devices, disable or tightly control removable media, prevent execution from user-writable and removable locations using application control, and ensure standard users cannot write to application installation directories. Maintain endpoint protection and DLL/search-path abuse detections, especially on systems where physical access cannot be fully controlled.

How to confirm the fix worked

Confirm the relevant Microsoft security update is installed through Windows Update, WSUS, Microsoft Update Catalog deployment records, or endpoint patch inventory. Validate that all affected Windows versions have received the July 2026 or later cumulative/security update that includes the fix. On representative systems, review installed update history and OS build numbers against Microsoft release documentation. Confirm application control or endpoint hardening policies block unsigned or untrusted binaries and libraries from removable media and user-writable paths. For exposure validation, search endpoints for XML-related DLLs or suspicious executable content in removable, temporary, desktop, downloads, and application working directories outside trusted Windows system paths.

Typical attack path

1. Identify a Windows client or server version affected by the Microsoft XML untrusted search path flaw.
2. Gain physical access to the device, its attached removable media, or a location that influences local file search behavior.
3. Place a crafted attacker-controlled file in a directory that Microsoft XML may search before the trusted Windows system directory.
4. Trigger or wait for software using Microsoft XML to invoke the vulnerable search path behavior.
5. Abuse the resulting load or use of the attacker-controlled file to bypass the intended security protection and affect local system confidentiality, integrity, or availability.

How to detect it

Look for evidence of local file planting and suspicious library/module loading around Microsoft XML usage. Useful sources include EDR telemetry, Sysmon Event ID 7 for image loads, Sysmon Event ID 11 for file creation, Windows Security Event ID 4688 for process creation, PowerShell logs, removable media/device control logs, and application control block/allow events. Hunt for msxml-related DLLs or executable files created outside trusted Windows system directories, particularly in removable drives, user profile paths, temporary folders, downloads folders, desktop folders, or application working directories. Investigate processes that load msxml-related DLLs from unexpected locations rather than C:\Windows\System32 or C:\Windows\SysWOW64. Correlate suspicious file creation, removable media insertion, interactive logon, and subsequent process/module-load events on the same endpoint. Because exploitation requires physical access and no public exploitation is reported, prioritize targeted forensic review of devices with unexplained local tampering, unauthorized console access, or removable media activity.

• msxml3.dll
• msxml4.dll
• msxml6.dll
• \msxml3.dll
• \msxml4.dll
• \msxml6.dll
• C:\Users\
• C:\Users\Public\
• C:\Windows\Temp\
• C:\Temp\
• \Downloads\
• \Desktop\
• \AppData\Local\Temp\
• E:\msxml3.dll
• E:\msxml6.dll
• F:\msxml3.dll
• F:\msxml6.dll
• ImageLoaded=*\msxml3.dll
• ImageLoaded=*\msxml6.dll
• TargetFilename=*\msxml3.dll
• TargetFilename=*\msxml6.dll

What your security team should do

• Prioritize patching shared, physically accessible, kiosk, lab, point-of-sale, and high-sensitivity Windows systems before lower-risk locked datacenter systems.
• Deploy the applicable Microsoft cumulative/security updates across all affected Windows client and server versions and verify installation through centralized inventory.
• Temporarily reduce exposure by restricting physical access, disabling unnecessary removable media use, and enforcing screen lock, BitLocker, Secure Boot, and tamper-resistant endpoint controls.
• Enable or tune EDR/Sysmon monitoring for suspicious module loads from removable media, user profile directories, temporary directories, and application working directories.
• Hunt for XML-related DLL names or recently created executable files in non-system directories, especially where creation occurred shortly before a process loaded the file.
• Use application control policies such as WDAC or AppLocker to block untrusted code from user-writable and removable locations.
• Because this is not currently KEV-listed and has low EPSS, treat it as a targeted physical-access risk rather than an internet-facing emergency, unless the organization operates many physically exposed Windows devices.