CVE-2026-32085

38th percentile - higher than 38% of all known CVEs

Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an authorized attacker to disclose information locally.

An authorized attacker with local access can obtain sensitive information via Windows RPC, potentially leading to a breach of data confidentiality. The risk applies to organizations where an attacker can gain local access to the system.

Apply security updates provided by Microsoft for Windows Remote Procedure Call. Additionally, restrict local access to the system and monitor for unusual RPC activity.