CVE-2026-96948

MediumCVSS 5.5/10Last modified Oct 16, 2026

Description

Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-969497.0Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.CVE-2026-96959.8An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain priv CVE-2026-969507.8Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.CVE-2026-969518.8Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypa CVE-2026-969528.8Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.CVE-2026-969537.8Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.CVE-2026-969568.0Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-969578.8Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-969587.5Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-969597.5Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-96966.4The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to, CVE-2026-969607.5Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.