This vulnerability (CVE-2026-20925) affects Windows 10 Version 1607 (build 10.0.14393.0) and is categorized under CWE-73: External Control of File Name or Path. It involves improper handling of file names or paths in the Windows NTLM authentication process, which could allow an attacker to spoof network communications. The CVSS 3.1 base score is 6.5 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating that the attack can be performed remotely without privileges but requires user interaction, and it impacts confidentiality with high impact but no integrity or availability impact. The vulnerability was published on January 13, 2026, and a patch is available from Microsoft.

An attacker can exploit this vulnerability to perform spoofing attacks over a network, potentially leading to unauthorized access to sensitive information due to compromised confidentiality. There is no impact on integrity or availability reported. No known exploits are currently active in the wild.

A patch is available to remediate this vulnerability. It is recommended to apply the official Microsoft update for Windows 10 Version 1607 (build 10.0.14393.0) as soon as possible to mitigate the risk. Since this is not a cloud service, remediation depends on applying the patch on affected systems. No additional vendor advisory content contradicts this guidance.