What happened
Microsoft Windows 11 is affected by CVE-2026-102868, a Windows Shell vulnerability involving the exposure of sensitive system information to an unauthorised control sphere. An attacker with local access to a host and a low-privileged account can disclose information. The attack requires no action from any user. The stated impact is disclosure of information; the supplied facts do not identify an impact on system integrity or availability. The vulnerability is rated medium, with an NVD score of 5.5. The weakness is classified as CWE-497. NVD analysis remains in progress, so the scope may change.
Who is affected
Vendor-published affected versions are Windows 11 version 23H2 on ARM64 and x64 systems, from 10.0.22631.0 to before 10.0.22631.7711; version 24H2 on ARM64 and x64 systems, from 10.0.26100.0 to before 10.0.26100.9445; version 25H2 on ARM64 and x64 systems, from 10.0.26200.0 to before 10.0.26200.9445; and version 26H1 on ARM64 and x64 systems, from 10.0.28000.0 to before 10.0.28000.3501. A fix is available. The supplied patch-status information does not identify fixed versions for every affected release; consult the vendor advisory for fixed-version details.
Recommended actions
- Apply the available vendor fix to affected Windows 11 deployments, using vendor guidance to confirm the applicable remediation.
- Restrict low-privileged account access on affected hosts to reduce opportunities for an attacker who has local access to exploit the flaw.
- Review privilege assignments and remove unnecessary low-privileged accounts or access, as part of ongoing privilege hygiene.
- Strengthen device control to limit unauthorised access to hosts and devices, addressing the local-access condition in the exploit path.
- Monitor endpoints for signs of unauthorised local access and activity associated with information disclosure.
