CVE-2026-20834
Unknown
Unknown - Not Provided
BaseFortify
Vulnerability report for CVE-2026-20834, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-01-13
Last updated on: 2026-01-15
Assigner: Microsoft Corporation
Description
Description
Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microsoft | windows_10_1607 | to 10.0.14393.8783 (exc) |
| microsoft | windows_10_1607 | to 10.0.14393.8783 (exc) |
| microsoft | windows_10_1809 | to 10.0.17763.8276 (exc) |
| microsoft | windows_10_1809 | to 10.0.17763.8276 (exc) |
| microsoft | windows_10_21h2 | to 10.0.19044.6809 (exc) |
| microsoft | windows_10_22h2 | to 10.0.19045.6809 (exc) |
| microsoft | windows_11_23h2 | to 10.0.22631.6491 (exc) |
| microsoft | windows_11_24h2 | to 10.0.26100.7623 (exc) |
| microsoft | windows_11_25h2 | to 10.0.26200.7623 (exc) |
| microsoft | windows_server_2008 | * |
| microsoft | windows_server_2008 | * |
| microsoft | windows_server_2008 | r2 |
| microsoft | windows_server_2012 | * |
| microsoft | windows_server_2012 | r2 |
| microsoft | windows_server_2016 | to 10.0.14393.8783 (exc) |
| microsoft | windows_server_2019 | to 10.0.17763.8276 (exc) |
| microsoft | windows_server_2022 | to 10.0.20348.4648 (exc) |
| microsoft | windows_server_2022_23h2 | to 10.0.25398.2092 (exc) |
| microsoft | windows_server_2025 | to 10.0.26100.32230 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-36 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory. |
| CWE-359 | The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected. |
