This vulnerability (CVE-2026-20847) involves the exposure of sensitive information in Windows Shell on Windows 10 Version 1607 (build 10.0.14393.0). The flaw allows an authorized attacker to conduct spoofing attacks over a network by leveraging the exposed sensitive information. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required. Microsoft has released an official fix to remediate this vulnerability.

The vulnerability allows an authorized attacker to gain access to sensitive information that should be protected, enabling spoofing attacks over a network. This could lead to unauthorized information disclosure but does not impact system integrity or availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20847 to remediate this vulnerability.