Security readout for executives and security teams
Plain-English summary
This flaw can let a user who already has authorized local access expose sensitive information through Windows Management Services. It does not provide remote entry or allow data modification, but disclosed information could increase risk on shared systems or systems where low-privilege accounts are not fully trusted.
Executive priority
Address through the normal security-update cycle, accelerating systems with shared access, sensitive data, or numerous local users. The medium severity and local-access requirement reduce immediate urgency, but potential high confidentiality impact makes prolonged deferral inappropriate.
Technical view
CVE-2026-20862 is a CWE-200 information-disclosure vulnerability with CVSS 3.1 score 5.5. Exploitation requires local access and low privileges, requires no user interaction, and has low attack complexity. The stated impact is high confidentiality loss without integrity or availability impact.
Likely exposure
Exposure includes the listed Windows 10, Windows 11, and Windows Server releases, including specified Server Core installations. Risk is most relevant where an attacker can obtain or already holds an authorized low-privilege local account. The bundle does not identify vulnerable configurations beyond product and version information.
Exploitation context
The attacker must be authorized, local, and low privileged. No user interaction is required. The source bundle reports no KEV listing and provides no evidence of active exploitation, public proof-of-concept code, or remote exploitability.
Researcher notes
The supplied evidence does not describe the exposed information, affected component internals, exploitation prerequisites beyond local low privileges, or specific update identifiers. Researchers should avoid inferring data types or attack chains and consult the evolving Microsoft advisory for technical and remediation details.
Mitigation direction
- Review the Microsoft advisory for applicable security updates and installation guidance.
- Prioritize updates on shared systems and hosts permitting low-privilege local access.
- Restrict unnecessary local accounts and review whether existing access remains justified.
- Use standard change controls and test applicable updates before broad deployment.
Validation and detection
- Inventory systems running the affected Windows editions and versions.
- Compare installed update status with the current Microsoft advisory.
- Confirm applicable security updates installed successfully on affected systems.
- Review local account assignments and identify unnecessary low-privilege access.
- Recheck the Microsoft advisory for later revisions or product-specific guidance.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-20862 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C1.83.6microsoftVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Windows Management Services Information Disclosure VulnerabilityCVE reference, microsoft · vendor-advisory, patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.