CVE-2026-118140
Improper access control in Windows Server for NFS allows an authorized attacker to disclose information locally.
CVSS
5.5
Medium
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-284 · CWE-497
Not enough EPSS history yet.
Improper access control in Windows Server for NFS allows an authorized attacker to disclose information locally.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1209837.6 HIG—
——0On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing (PBR), traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This could potentially allow unauthenticated hosts access to networks. Additionally Layer 2 and Layer 3 control packets from unauthenticated hosts may get copied to the CPU.3hCVE-2026-961375.5 MED—
——0Exposure of sensitive system information to an unauthorized control sphere in Windows Graphics Kernel allows an authorized attacker to disclose information locally.4hCVE-2026-960015.5 MED—
——0Exposure of sensitive system information to an unauthorized control sphere in Windows Bluetooth Service allows an authorized attacker to disclose information locally.4hCVE-2026-1207808.3 HIG—
——0Improper access control in Visual Studio Code allows an unauthorized attacker to execute code over a network.4hCVE-2026-1199424.7 MED—
——0Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.4hCVE-2026-1198825.3 MED—
——0Exposure of sensitive system information to an unauthorized control sphere in Windows Remote Desktop Services allows an authorized attacker to disclose information over a network.3h