This vulnerability (CVE-2026-23674) arises from improper resolution of path equivalence in the Windows MapUrlToZone function in Windows 10 Version 1607. It enables an attacker to bypass security features remotely without privileges or user interaction. The CVSS 3.1 base score is 7.5, indicating high severity, with a network attack vector, low attack complexity, no privileges required, and no user interaction needed. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

Successful exploitation allows an attacker to bypass security features remotely, potentially leading to unauthorized access or actions that compromise confidentiality. The vulnerability does not impact integrity or availability directly. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft for Windows 10 Version 1607 (build 10.0.14393.0). Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23674 to remediate this vulnerability.