CVE-2026-69403: CWE-862: Missing Authorization in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-69403) involves missing authorization checks in the Windows SMB Server component on Windows 10 Version 1607 and related builds. It allows an attacker with local authorized access to disclose information that should be protected. The CVSS 3.1 base score is 5.5, reflecting a medium severity impact primarily on confidentiality. The vulnerability affects multiple Windows 10 versions starting from build 10.0.14393.0 up to but excluding various patched builds (e.g., <10.0.14393.9512, <10.0.17763.9245, <10.0.19044.7725, etc.). Microsoft has published an official fix for this vulnerability. There are no known exploits in the wild as of the publication date.

An authorized local attacker can exploit this vulnerability to disclose sensitive information on affected Windows 10 systems. The impact is limited to confidentiality loss; integrity and availability are not affected. The medium severity rating reflects the requirement for local access and limited scope of impact.

An official fix is available from Microsoft. Users and administrators should apply the security updates corresponding to their Windows 10 build to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69403 for detailed patch information and update instructions.