CVE catalog
CVE-2026-32151
Exposure of sensitive information to an unauthorized…
Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a network.
- Severity
- Medium · CVSS 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.75% · Oct 27, 2026
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [],
"fixed_versions": [],
"distribution_packages": [
{
"name": "windows_10_1607",
"ecosystem": "cpe",
"fixed_version": "10.0.14393.9060"
},
{
"name": "windows_10_1809",
"ecosystem": "cpe",
"fixed_version": "10.0.17763.8644"
},
{
"name": "windows_10_21h2",
"ecosystem": "cpe",
"fixed_version": "10.0.19044.7184"
},
{
"name": "windows_10_22h2",
"ecosystem": "cpe",
"fixed_version": "10.0.19045.7184"
},
{
"name": "windows_11_23h2",
"ecosystem": "cpe",
"fixed_version": "10.0.22631.6936"
},
{
"name": "windows_11_24h2",
"ecosystem": "cpe",
"fixed_version": "10.0.26100.8246"
},
{
"name": "windows_11_25h2",
"ecosystem": "cpe",
"fixed_version": "10.0.26200.8246"
},
{
"name": "windows_11_26h1",
"ecosystem": "cpe",
"fixed_version": "10.0.28000.1836"
},
{
"name": "windows_server_2012",
"ecosystem": "cpe",
"fixed_version": ""
},
{
"name": "windows_10_1607",
"ranges": [
{
"fixed": "10.0.14393.9060",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "10.0.14393.9060",
"provider_record_id": "NVD-CVE-2026-32151"
},
{
"name": "windows_10_1809",
"ranges": [
{
"fixed": "10.0.17763.8644",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "10.0.17763.8644",
"provider_record_id": "NVD-CVE-2026-32151"
},
{
"name": "windows_10_21h2",
"ranges": [
{
"fixed": "10.0.19044.7184",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "10.0.19044.7184",
"provider_record_id": "NVD-CVE-2026-32151"
},
{
"name": "windows_10_22h2",
"ranges": [
{
"fixed": "10.0.19045.7184",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "10.0.19045.7184",
"provider_record_id": "NVD-CVE-2026-32151"
},
{
"name": "windows_11_23h2",
"ranges": [
{
"fixed": "10.0.22631.6936",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "10.0.22631.6936",
"provider_record_id": "NVD-CVE-2026-32151"
},
{
"name": "windows_11_24h2",
"ranges": [
{
"fixed": "10.0.26100.8246",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "10.0.26100.8246",
"provider_record_id": "NVD-CVE-2026-32151"
},
{
"name": "windows_11_25h2",
"ranges": [
{
"fixed": "10.0.26200.8246",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "10.0.26200.8246",
"provider_record_id": "NVD-CVE-2026-32151"
},
{
"name": "windows_11_26h1",
"ranges": [
{
"fixed": "10.0.28000.1836",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "10.0.28000.1836",
"provider_record_id": "NVD-CVE-2026-32151"
},
{
"name": "windows_server_2012",
"ranges": [],
"ecosystem": "cpe",
"fixed_version": "",
"provider_record_id": "NVD-CVE-2026-32151"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
Observed: