Files or Directories Accessible to External Parties in Microsoft Windows and Windows Server - CVE-2026-85812
Published: October 14, 2026
Vulnerability identifier: #VU155161
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85812
CWE-ID: CWE-552
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose information.
The vulnerability exists due to files or directories being accessible to external parties in Windows Bind Filter Driver when accessing local files or directories. A local user can access exposed files or directories to disclose information.
The exposed information is limited to a small amount of internal system data, such as an internal identifier value, and does not include user content or personal data.
Affected software
Microsoft Windows
Windows Server
Windows Server
How to mitigate CVE-2026-85812
Install security update from vendor's website.
Microsoft Windows - addressed in versions 10 21H2 10.0.19044.7807, 11 23H2 10.0.22631.7652, 11 24H2 10.0.26100.9711, 11 25H2 10.0.26200.9711, 11 26H1 10.0.28000.3231
Windows Server - addressed in versions 2022 10.0.20348.5761, 2025 10.0.26100.33650
Windows Server - addressed in versions 2022 10.0.20348.5761, 2025 10.0.26100.33650