CVE-2026-25186

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Exposure of sensitive information to an unauthorized actor in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to disclose information locally.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1607	>= 10.0.14393.0, < 10.0.14393.8957
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.8511
Microsoft	Windows 10 Version 21H2	>= 10.0.19044.0, < 10.0.19044.7058
Microsoft	Windows 10 Version 22H2	>= 10.0.19045.0, < 10.0.19045.7058
Microsoft	Windows 11 version 22H3	>= 10.0.22631.0, < 10.0.22631.6783
Microsoft	Windows 11 Version 23H2	>= 10.0.22631.0, < 10.0.22631.6783
Microsoft	Windows 11 Version 24H2	>= 10.0.26100.0, < 10.0.26100.8037
Microsoft	Windows 11 Version 25H2	>= 10.0.26200.0, < 10.0.26200.8037
Microsoft	Windows 11 version 26H1	>= 10.0.28000.0, < 10.0.28000.1719
Microsoft	Windows Server 2012	>= 6.2.9200.0, < 6.2.9200.25973
Microsoft	Windows Server 2012 (Server Core installation)	>= 6.2.9200.0, < 6.2.9200.25973
Microsoft	Windows Server 2012 R2	>= 6.3.9600.0, < 6.3.9600.23074
Microsoft	Windows Server 2012 R2 (Server Core installation)	>= 6.3.9600.0, < 6.3.9600.23074
Microsoft	Windows Server 2016	>= 10.0.14393.0, < 10.0.14393.8957
Microsoft	Windows Server 2016 (Server Core installation)	>= 10.0.14393.0, < 10.0.14393.8957
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.8511
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.8511
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.4893
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	>= 10.0.25398.0, < 10.0.25398.2207
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.32522
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.32522

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25186Vendor Advisory

Timeline

Published: Mar 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-251877.8Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.CVE-2026-251888.8Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to elevate privileges over an adjacent network.CVE-2026-251897.8Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2026-25195.3The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parame CVE-2026-251907.8Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally.CVE-2026-251918.4The installer of FinalCode Client provided by Digital Arts Inc. contains an issue with the DLL search path. If a user is directed to place a CVE-2026-251929.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate d CVE-2026-251938.6Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentia CVE-2026-251941.8Out-of-bounds write in the firmware for the Intel(R) Slim Bootloader may allow a denial of service. System software adversary with a privile CVE-2026-251956.6An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote CVE-2026-251968.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote co CVE-2026-251978.1A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.