CVE-2026-59135: Windows 10 1607 Information Disclosure Flaw

CVE-2026-59135 Overview

CVE-2026-59135 is a weak authentication vulnerability in the Microsoft Windows Search Component. An authorized local attacker can exploit the weakness to disclose sensitive information from the affected system. The flaw is tracked under [CWE-1390: Weak Authentication] and requires local access with low privileges but no user interaction.

Microsoft published the advisory on 2026-08-11, covering supported Windows client and server releases from Windows 10 1607 through Windows Server 2025. The vulnerability affects confidentiality only; integrity and availability are not impacted. No public exploit is available, and CISA has not added CVE-2026-59135 to the Known Exploited Vulnerabilities catalog.

Critical Impact
An authenticated local attacker can extract sensitive information indexed or handled by the Windows Search Component across every supported Windows client and server SKU.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-59135 published to NVD
2026-08-11 - Microsoft releases the CVE-2026-59135 Update Guide
2026-08-12 - Last updated in NVD database
2026-08-13 - EPSS score recorded at 0.32%

Technical Details for CVE-2026-59135

Vulnerability Analysis

The Windows Search Component indexes files, email items, and application data to serve fast local queries. The service runs with elevated privileges and maintains an index that spans user profiles and system locations. CVE-2026-59135 stems from weak authentication controls within this component, permitting an authenticated local user to retrieve information they should not access.

Because the attack is local, the adversary must first hold a valid account on the target host. The vulnerability does not require user interaction, and the attack complexity is low. Exploitation yields confidentiality impact only; the attacker cannot modify data or crash the service through this flaw.

Root Cause

The root cause is classified as [CWE-1390: Weak Authentication]. The Windows Search Component does not sufficiently verify the identity or authorization of a caller before returning indexed content. As a result, requests originating from a low-privileged principal can reach data owned by other users or by the system context.

Attack Vector

An authenticated attacker interacts with the Windows Search service or its indexed data stores from a local session. By issuing crafted queries or interacting with exposed interfaces of the Search Component, the attacker retrieves indexed content that bypasses the intended access controls. No network access, elevated privileges, or user interaction are required beyond the initial local logon.

No public proof-of-concept code has been published. Refer to the Microsoft CVE-2026-59135 Update Guide for vendor-supplied technical details.

Detection Methods for CVE-2026-59135

Indicators of Compromise

Unusual query patterns against the SearchIndexer.exe process from non-administrative user contexts
Access attempts to %ProgramData%\Microsoft\Search\Data by unexpected accounts
Repeated enumeration of Windows Search COM interfaces or the Search-ms: protocol handler by standard users
Local processes reading indexed content that spans multiple user profiles within short time windows

Detection Strategies

Baseline normal Windows Search activity per user, then alert on deviations such as cross-profile index reads.
Correlate SearchIndexer.exe child process activity with the invoking user SID to spot privilege boundary crossings.
Monitor endpoint telemetry for unsigned or unusual binaries invoking Windows Search APIs.

Monitoring Recommendations

Enable object access auditing on Windows Search data directories and index files.
Forward Windows Search operational logs and Sysmon process/file events to a central analytics platform.
Track patch compliance for KBs referenced by the Microsoft advisory across all Windows client and server assets.

How to Mitigate CVE-2026-59135

Immediate Actions Required

Apply the Microsoft security update referenced in the CVE-2026-59135 Update Guide to every affected Windows client and server.
Prioritize multi-user systems such as terminal servers, jump hosts, and shared workstations where local accounts are common.
Review local account inventories and remove unnecessary interactive logon rights.

Patch Information

Microsoft has released updates addressing CVE-2026-59135 for all supported Windows 10, Windows 11, and Windows Server versions listed in the advisory. Administrators should consult the Microsoft Update Guide for the specific KB article and build numbers matching each deployed SKU and channel.

Workarounds

Restrict interactive and remote interactive logon rights on sensitive systems to reduce the local attacker population.
Where operationally acceptable, disable the Windows Search service (WSearch) on servers that do not require local indexing.
Exclude sensitive directories from Windows Search indexing until the patch is deployed.
Enforce least privilege on shared hosts and remove standard users from systems that hold high-value indexed content.

bash

# Configuration example: temporarily disable the Windows Search service on servers that do not require it
sc.exe config WSearch start= disabled
sc.exe stop WSearch