CVE-2026-42906

Published: Jun 9, 2026Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: secure@microsoft.com (Secondary)

Description

Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information locally.

Affected (16)

Products: Microsoft: Windows 10 21h2, Windows 10 22h2, Windows 11 23h2, Windows 11 24h2, Windows 11 25h2, Windows 11 26h1, Windows Server 2022, Windows Server 2025

8 products

Windows 10 21h2

Windows 10 22h2

Windows 11 23h2

Windows 11 24h2

Windows 11 25h2

Windows 11 26h1

Windows Server 2022

Windows Server 2025

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 10 21h2	version < 10.0.19044.7417
Microsoft Windows 10 21h2	version < 10.0.19044.7417
Microsoft Windows 10 21h2	version < 10.0.19044.7417
Microsoft Windows 10 22h2	version < 10.0.19045.7417
Microsoft Windows 10 22h2	version < 10.0.19045.7417
Microsoft Windows 10 22h2	version < 10.0.19045.7417
Microsoft Windows 11 23h2	version < 10.0.22631.7219
Microsoft Windows 11 23h2	version < 10.0.22631.7219
Microsoft Windows 11 24h2	version < 10.0.26100.8655
Microsoft Windows 11 24h2	version < 10.0.26100.8655
Microsoft Windows 11 25h2	version < 10.0.26200.8655
Microsoft Windows 11 25h2	version < 10.0.26200.8655
Microsoft Windows 11 26h1	version < 10.0.28000.2269
Microsoft Windows 11 26h1	version < 10.0.28000.2269
Microsoft Windows Server 2022	version < 10.0.20348.5256
Microsoft Windows Server 2025	version < 10.0.26100.32995

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42906

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.