CVE-2026-70019: Windows Compressed Folder Disclosure Flaw

CVE-2026-70019 Overview

CVE-2026-70019 is an information disclosure vulnerability in the Windows Compressed Folder feature. The flaw involves improper handling of hard links within compressed archives, allowing an unauthenticated remote attacker to disclose sensitive information over a network. Exploitation requires user interaction, typically the target opening or extracting a malicious archive. Microsoft published the advisory on 2026-09-08. The weakness is classified under CWE-65 (Windows Hard Link).

Critical Impact
A remote attacker can craft a malicious compressed folder containing hard links that redirect file operations to sensitive local files, disclosing their contents to the attacker once a user opens the archive.

Affected Products

Microsoft Windows (Compressed Folder component)
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds
Systems processing untrusted .zip archives via the built-in Compressed Folders shell handler

Discovery Timeline

2026-09-08 - CVE-2026-70019 published to NVD
2026-09-08 - Microsoft Security Update Guide entry released
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-70019

Vulnerability Analysis

The vulnerability exists in how the Windows Compressed Folder shell extension processes hard link entries embedded in archive files. When a user extracts or previews a crafted archive, the handler follows the hard link reference and reads content from a file the attacker specifies rather than the intended archive payload. The attacker can leverage this to exfiltrate the contents of files accessible to the target user account. Because the primary impact is confidentiality (C:H/I:N/A:N), the vulnerability does not permit modification of data or denial of service. The attack succeeds over the network when the malicious archive is delivered via web download, email attachment, or file share.

Root Cause

The root cause is a hard link handling flaw (CWE-65) in the Compressed Folder component. The extraction logic does not adequately validate or sanitize hard link targets contained in archive metadata. This allows link entries to point to arbitrary paths outside the intended extraction scope, enabling unauthorized disclosure of file contents when the target file is subsequently read or displayed by the shell handler.

Attack Vector

An unauthenticated attacker crafts a compressed archive containing hard link entries referencing sensitive files on the victim system. The attacker delivers the archive through a network-reachable channel such as HTTPS download, phishing email, or SMB share. The victim opens or extracts the archive using Windows Compressed Folder, at which point the handler follows the hard link and exposes the referenced file's contents. No prior authentication is required, and the interaction is limited to a common user action.

A public proof-of-concept is not available at the time of publication. See the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-70019

Indicators of Compromise

Compressed archives (.zip) received from untrusted sources containing hard link entries or entries with unusual path metadata.
Shell process (explorer.exe) reading sensitive files immediately after a user opens or extracts an archive.
Outbound network transfers of files that correlate with recent archive extraction activity.

Detection Strategies

Inspect inbound archives at email and web gateways for hard link entries in ZIP central directory records.
Correlate archive extraction events with subsequent reads of sensitive paths such as C:\Users\<user>\ documents or credential stores.
Alert on explorer.exe accessing files outside the extraction target directory shortly after archive open events.

Monitoring Recommendations

Enable file access auditing on high-value directories to capture reads triggered by shell handlers.
Log process creation and file I/O for explorer.exe and archive handling processes using Sysmon or equivalent telemetry.
Monitor endpoint EDR telemetry for anomalous file read patterns following archive downloads from external sources.

How to Mitigate CVE-2026-70019

Immediate Actions Required

Apply the Microsoft security update referenced in the Security Update Guide as soon as it is available for affected builds.
Block or quarantine archives received from untrusted external senders at the email gateway pending patch deployment.
Educate users to avoid opening .zip files from unverified sources, especially those delivered via email or messaging platforms.

Patch Information

Microsoft has published guidance for CVE-2026-70019 through the Microsoft Security Response Center. Administrators should consult the Microsoft Security Update Guide entry for the specific KB articles, affected Windows versions, and applicable cumulative updates. Deploy the patch through Windows Update, WSUS, or your configured patch management workflow.

Workarounds

Use a third-party archive utility that enforces strict extraction path validation instead of the built-in Compressed Folder handler.
Configure Group Policy or Attack Surface Reduction rules to restrict explorer.exe from reading sensitive directories during archive operations.
Enforce Mark-of-the-Web propagation so extracted files from internet-sourced archives inherit restricted zone handling.

bash

# Example: block .zip attachments at Exchange transport rule (PowerShell)
New-TransportRule -Name "Block External ZIP Attachments" \
  -FromScope NotInOrganization \
  -AttachmentExtensionMatchesWords "zip" \
  -RejectMessageReasonText "ZIP attachments from external senders are blocked pending CVE-2026-70019 remediation."