CVE-2026-69507: CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory in Microsoft Windows 11 version 23H2

This vulnerability, tracked as CVE-2026-69507 and classified under CWE-538, involves the insertion of sensitive information into files or directories that are accessible externally in the Windows Search Component of Windows 11 version 23H2. An attacker with authorized access can exploit this flaw to disclose sensitive information over a network. The CVSS 3.1 base score is 5.7 (medium severity), with network attack vector, low attack complexity, required privileges, and user interaction. The vulnerability does not impact integrity or availability but has a high impact on confidentiality. Microsoft has published an official fix for affected versions.

An authorized attacker can cause sensitive information to be written to locations accessible externally, enabling information disclosure over a network. The confidentiality impact is high, but there is no impact on integrity or availability. The attack requires low complexity, privileges, and user interaction.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Windows 11 version 23H2 as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69507. No additional mitigations are specified beyond applying the official patch.