OTPulse

Windows SMB Information Disclosure Vulnerability

MonitorCVSS 5.5CVE-2026-54997Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in Windows SMB service allows an authorized local attacker to disclose sensitive information residing in uninitialized memory. The vulnerability affects a wide range of Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 editions. An attacker with a local user account can trigger code paths that access memory that should have been properly cleared, potentially exposing sensitive data from previous operations or other user sessions.

What this means
What could happen
An attacker with local access to an affected Windows system could read sensitive information from memory that should have been cleared, potentially exposing credentials or other confidential data. This is a local-only vulnerability with limited immediate operational impact on industrial systems.
Who's at risk
Operators running Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025 should be aware of this vulnerability. While primarily an IT infrastructure concern, any engineering workstations, HMI systems, or historians running affected Windows versions could be impacted.
How it could be exploited
An attacker with a local user account on an affected Windows system can trigger the SMB code path that accesses uninitialized memory, reading information that persists from previous system operations or other users' activities.
Prerequisites
  • Local user account on the Windows system
  • Ability to interact with the Windows SMB service locally
Local access requiredLow attack complexityAffects multiple Windows versions and Server editions
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (23)
23 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9020
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9020
Windows Server 2019All versionsBuild 10.0.17763.9020
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9020
Windows Server 2022All versionsBuild 10.0.20348.5386
Remediation & Mitigation
0/2
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the 2026-July Microsoft security update to all affected Windows versions
Long-term hardening
0/1
HARDENINGRestrict local access to Windows systems by enforcing strong credential controls and account lockdown policies
View full vendor advisory
API: /api/v1/advisories/de449ae4-71a2-426e-9fc8-b657cafb1134

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows SMB Information Disclosure Vulnerability | CVSS 5.5 - OTPulse