CVE-2026-50473: Windows File Explorer Info Disclosure

CVE-2026-50473 Overview

CVE-2026-50473 is an information disclosure vulnerability in Windows File Explorer. The flaw is classified under [CWE-200], exposure of sensitive information to an unauthorized actor. An authorized local attacker can exploit the weakness to read sensitive data they should not be able to access.

Microsoft published the advisory on July 14, 2026. The vulnerability requires local access and low privileges, and it does not require user interaction. Exploitation impacts confidentiality only, with no direct effect on integrity or availability.

Critical Impact
An authenticated local user can read sensitive information exposed through Windows File Explorer, enabling reconnaissance and follow-on attacks against the affected host.

Affected Products

Microsoft Windows File Explorer (see Microsoft advisory for affected builds)
Supported Windows client editions listed in the vendor advisory
Supported Windows Server editions listed in the vendor advisory

Discovery Timeline

2026-07-14 - CVE-2026-50473 published to NVD
2026-07-14 - Microsoft advisory released for CVE-2026-50473
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-50473

Vulnerability Analysis

CVE-2026-50473 is an information disclosure weakness in Windows File Explorer. The component exposes sensitive information to an actor that should not have access under normal operating conditions. Microsoft categorizes the issue as local disclosure, meaning the attacker must already have a foothold on the target system.

Exploitation yields access to data handled or referenced by File Explorer. That data may include file metadata, path information, or content that File Explorer processes on behalf of higher-privileged users or system components. The vulnerability does not permit code execution, privilege escalation, or tampering by itself.

However, information disclosure flaws frequently serve as building blocks for larger attack chains. Data recovered through this vector can support credential theft, lateral movement, or targeted follow-on exploitation on the same host.

Root Cause

The root cause is improper access control over sensitive data surfaced by Windows File Explorer, corresponding to [CWE-200]. File Explorer returns or renders information to callers who should not receive it under the intended trust model. Microsoft has not published low-level details about the affected code path.

Attack Vector

The attack vector is local. An attacker must be authenticated on the target Windows system with at least low privileges. No user interaction is required from a victim. The attacker interacts with File Explorer or its underlying interfaces to retrieve data outside their authorization scope.

See the Microsoft CVE-2026-50473 Advisory for vendor guidance and affected build details.

Detection Methods for CVE-2026-50473

Indicators of Compromise

Unexpected explorer.exe process activity spawned by non-interactive or low-privilege user contexts.
File Explorer access to paths or objects outside the invoking user's normal working set.
Enumeration patterns against directories containing credentials, tokens, or configuration files shortly after standard user logon.

Detection Strategies

Monitor endpoint telemetry for anomalous File Explorer child processes and handle activity tied to low-privilege accounts.
Correlate local logon events with subsequent access to sensitive directories such as user profile stores, credential caches, and application data folders.
Baseline normal File Explorer behavior per user role and alert on deviations, particularly bulk file or metadata enumeration.

Monitoring Recommendations

Enable Windows object access auditing on sensitive file locations and forward events to a centralized analytics platform.
Track Sysmon Event ID 1 (process creation) and Event ID 11 (file create) for explorer.exe executions in unusual sessions.
Retain host telemetry long enough to reconstruct sequences that combine information disclosure with later privilege abuse.

How to Mitigate CVE-2026-50473

Immediate Actions Required

Apply the Windows security update referenced in the Microsoft CVE-2026-50473 Advisory as soon as it is available for your build.
Inventory Windows endpoints and servers to identify systems that expose File Explorer to interactive local users.
Prioritize patching on multi-user systems such as Remote Desktop Session Hosts and shared workstations.

Patch Information

Microsoft addresses CVE-2026-50473 through its monthly security update channel. Refer to the Microsoft CVE-2026-50473 Advisory for the specific KB numbers, affected product builds, and superseded updates that apply to your environment.

Workarounds

Restrict interactive and remote interactive logon rights to trusted administrative users on sensitive systems.
Apply least-privilege principles to reduce the number of accounts able to invoke File Explorer on servers and shared hosts.
Enforce strong file system ACLs on directories containing credentials, keys, and configuration data to limit exposure if File Explorer leaks references.

bash

# Configuration example: verify installed updates and review interactive logon rights
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 20

# Review accounts granted interactive logon rights on a host
secedit /export /cfg C:\Temp\secpol.cfg
Select-String -Path C:\Temp\secpol.cfg -Pattern "SeInteractiveLogonRight|SeRemoteInteractiveLogonRight"