{"id":"CVE-2026-102868","aliases":[],"cve":{"records":[{"id":"CVE-2026-102868","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-29T17:27:07.499Z","published":"2026-11-10T18:14:59.628Z","modified":"2026-11-13T18:03:54.830Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-11-13T18:03:54.830Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T21:21:34.074Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102868","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-497","description":"CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*","versionStartIncluding":"10.0.22631.0","versionEndExcluding":"10.0.22631.7711"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*","versionStartIncluding":"10.0.22631.0","versionEndExcluding":"10.0.22631.7711"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*","versionStartIncluding":"10.0.26100.0","versionEndExcluding":"10.0.26100.9445"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*","versionStartIncluding":"10.0.26200.0","versionEndExcluding":"10.0.26200.9445"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:arm64:*","versionStartIncluding":"10.0.28000.0","versionEndExcluding":"10.0.28000.3501"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T21:17:26.920720Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Windows Shell Information Disclosure Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.","score":5.5,"severity":"medium","published":"2026-11-10T18:14:59.628Z","modified":"2026-11-13T18:03:54.830Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Windows 11 version 23H2","platforms":["ARM64-based Systems"],"versions":[{"version":"10.0.22631.0","status":"affected","lessThan":"10.0.22631.7711","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-102868"},{"vendor":"Microsoft","name":"Windows 11 Version 23H2","platforms":["x64-based Systems"],"versions":[{"version":"10.0.22631.0","status":"affected","lessThan":"10.0.22631.7711","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-102868"},{"vendor":"Microsoft","name":"Windows 11 Version 24H2","platforms":["ARM64-based Systems","x64-based Systems"],"versions":[{"version":"10.0.26100.0","status":"affected","lessThan":"10.0.26100.9445","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-102868"},{"vendor":"Microsoft","name":"Windows 11 Version 25H2","platforms":["ARM64-based Systems","x64-based Systems"],"versions":[{"version":"10.0.26200.0","status":"affected","lessThan":"10.0.26200.9445","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-102868"},{"vendor":"Microsoft","name":"Windows 11 version 26H1","platforms":["ARM64-based Systems","x64-based Systems"],"versions":[{"version":"10.0.28000.0","status":"affected","lessThan":"10.0.28000.3501","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-102868"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102868"],"sources":[{"name":"CVE","id":"CVE-2026-102868","modified":"2026-11-13T18:03:54.830Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-102868"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","score":5.5}],"sourceAffected":[],"observedAt":"2026-11-13T18:42:26.519Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:20:31.829Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-12T12:00:44.866Z","attemptedAt":"2026-11-12T12:00:44.866Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-12T12:00:31.982Z","attemptedAt":"2026-11-12T12:00:31.982Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-12T12:00:33.002Z","attemptedAt":"2026-11-12T12:00:33.002Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-12T12:00:33.002Z","attemptedAt":"2026-11-12T12:00:33.002Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-vvm9-vq9q-xr5c","url":"https://github.com/advisories/GHSA-vvm9-vq9q-xr5c","modified":"2026-11-10T21:32:22Z","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-12T12:00:31.982Z"},{"source":"ENISA EUVD","id":"EUVD-2026-121712","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-121712","modified":"Nov 11, 2026, 5:10:09 PM","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","checkedAt":"2026-11-12T12:00:33.002Z"},{"source":"NVD","id":"CVE-2026-102868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102868","modified":"2026-11-10T22:17:48.787","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-12T12:00:44.866Z"}],"aiSummary":{"text":"Windows Shell in Windows 11 versions 23H2, 24H2, 25H2, and 26H1 allows an authorized attacker to disclose sensitive system information locally. The affected versions are 10.0.22631.0 to 10.0.22631.7711, 10.0.26100.0 to 10.0.26100.9445, 10.0.26200.0 to 10.0.26200.9445, and 10.0.28000.0 to 10.0.28000.3501. An authorized attacker can exploit this vulnerability.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-11T04:41:05.422Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-102868"}]}}