Missing Authentication for Critical Function in Microsoft Windows - CVE-2026-96183
Published: October 14, 2026
Vulnerability identifier: #VU155413
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-96183
CWE-ID: CWE-306
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to missing authentication for a critical function in Windows Health and Optimized Experiences Service when handling local access to diagnostic information. A local user can access diagnostic data collected by the service to disclose sensitive information.
The diagnostic data can include system configuration, application crash, performance, and kernel driver allocation data.
Affected software
Microsoft Windows
How to mitigate CVE-2026-96183
Install security update from vendor's website.
Microsoft Windows - addressed in versions 11 24H2 10.0.26100.9711, 11 25H2 10.0.26200.9711, 11 26H1 10.0.28000.3231