KB5101650: Microsoft’s July Patch Closes File Explorer Data Leak Risk

Microsoft shipped its July 2026 security updates on July 14, and among the fixes is a patch for a vulnerability in Windows File Explorer that could allow a locally authenticated attacker to steal confidential information. The flaw, tracked as CVE-2026-50473, carries a CVSS 3.1 base score of 5.5 and affects every supported version of Windows 10, Windows 11, and Windows Server, including Server Core installations. The core update for Windows 11 versions 24H2 and 25H2 arrives as KB5101650, advancing those releases to builds 26100.8875 and 26200.8875, respectively.

For everyday users, the vulnerability is not a remote, internet-based threat. To exploit it, an attacker must already have a foothold on your machine—whether through a local account, malware running in a user context, or remote interactive access. But once that access is obtained, no additional user interaction is required, and the information that can be exposed carries a “High” confidentiality rating according to Microsoft’s severity assessment. That means sensitive data you store, browse, or manage with File Explorer could be silently harvested, potentially aiding credential theft or lateral movement in a corporate network.

What Actually Changed: A Closer Look at the Flaw and the Fix

The vulnerability is classified as CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. Microsoft has not publicly detailed the exact mechanism—whether it involves file previews, metadata handling, network paths, or shell extensions—but the CVSS vector reveals a great deal about the attack prerequisites:

• Attack Vector (AV): Local – The attacker must run code on the target machine.
• Attack Complexity (AC): Low – No special conditions are required to trigger the flaw.
• Privileges Required (PR): Low – Even a low-privileged user account can exploit it.
• User Interaction (UI): None – The victim does not need to click anything, open an attachment, or approve a prompt.
• Scope (S): Unchanged – The vulnerable component and the impacted resource are in the same security context.
• Confidentiality Impact (C): High – There is a total information disclosure, resulting in all resources within the impacted component being accessed by the attacker.
• Integrity Impact (I): None – Data cannot be modified.
• Availability Impact (A): None – System operation is unaffected.

This combination makes CVE-2026-50473 a prime candidate for post-compromise information gathering. An attacker who already has limited access can quietly pull sensitive filesystem data without raising alarms, using only built‑in File Explorer functionality that system monitoring tools may not flag as malicious.

The fix is delivered through the July 2026 cumulative updates. For Windows 11 24H2 and 25H2, KB5101650 rolls in both the security patches and the non‑security improvements previously offered in the June optional preview update. The table below lists the build numbers that contain the correction for each affected Windows version.

Notably, both full desktop and Server Core installations are affected for Windows Server 2016, 2019, and 2025. Even though Server Core lacks the graphical File Explorer interface, it includes underlying components that share code with the vulnerable module. System administrators should therefore apply the updates to all server roles, not just those with interactive desktop sessions.

There is, however, a deployment wrinkle. Microsoft has flagged a compatibility hold for a limited set of Dell devices with Intel processors. On those systems, KB5101650 may not be automatically offered because of reports that the update can cause unexpected shutdowns, performance degradation, excessive heat, and battery drain. Microsoft and Dell are working on a resolution, so bypassing the safeguard hold to force the patch is not recommended—but for unaffected hardware, the update should be installed normally through Windows Update, WSUS, or Intune.

What It Means for You: Home Users vs. IT Admins

For Home Users

If you manage your own Windows PC, this vulnerability should not cause panic, but it deserves attention. Here’s the practical risk:

• No drive-by attacks. A random website cannot exploit this bug. An attacker needs code running on your computer, which typically means malware you’ve already downloaded or a compromised application.
• Privacy implications. Because no user interaction is needed, a malicious program with low privileges could quietly copy your File Explorer data—file names, folder structures, and possibly more sensitive metadata—without you knowing.
• Data exfiltration risk. The leaked information could include personal documents, financial records, or work files stored locally. If you use OneDrive or similar synced folders, the data exposed might reflect cloud content as well.

The fix is straightforward: install the July cumulative update. For most users, Windows Update will handle this automatically. To verify, check your build number by typing “winver” in the Start menu; the number should match the fixed build for your Windows version from the table above.

For IT Administrators and Security Teams

Enterprise environments face a different risk calculus. CVE-2026-50473 is not a remote zero-click vulnerability that compromises the perimeter. Its value to an attacker lies entirely in post-exploitation information gathering, which makes it a significant enabler for lateral movement and privilege escalation once an initial foothold exists.

Key considerations:

• Prioritize sensitive workstations. Systems used by finance, HR, legal, developers, and administrators—where confidential files are routinely accessed—should be patched first. A local information disclosure flaw becomes far more dangerous when the compromised user handles deployment keys, intellectual property, or personally identifiable information.
• Server Core is not immune. Even though these installations lack the Explorer GUI, the shared vulnerable code means information leaks could still occur through background processes or remote management tools that interact with the filesystem. Every affected server, regardless of role, must be updated.
• No verified workarounds. Microsoft has not published any mitigation strategy—disabling thumbnails, preview handlers, or network browsing is pure speculation and may disrupt legitimate workflows without actually closing the attack surface. The only assured defense is the patch.
• Verify build numbers, not just KB presence. A machine that has downloaded KB5101650 but hasn’t restarted remains vulnerable because the updated binaries are not active. Use endpoint management tools to confirm the running OS build against the fixed version list.
• Monitor the Dell safeguard hold. If your organization uses affected Dell hardware, track Microsoft’s Windows release health dashboard for updates on when the hold is lifted. Do not forcibly skip the hold unless you accept the performance and stability risks described.

How We Got Here: Context and Timeline

CVE-2026-50473 is part of Microsoft’s regular July 2026 Patch Tuesday release—the second Tuesday of the month, as always. The vulnerability was disclosed in the Microsoft Security Response Center (MSRC) guide at the same time the updates became available, with details corroborated by the National Vulnerability Database (NVD) and the Cybersecurity and Infrastructure Security Agency (CISA).

At the time of publication, CISA’s Stakeholder-Specific Vulnerability Categorization (SSVC) indicated no known exploitation in the wild, and rated the technical impact as “partial.” That is consistent with Microsoft’s own “Confirmed” report confidence rating: the vendor acknowledges the flaw exists and has credible technical evidence, but there is no sign of active attacks. The NVD had not yet completed its own enrichment analysis, so Microsoft’s CVSS score remains the definitive public assessment.

This pattern—a local information disclosure in a ubiquitous Windows component—is not unprecedented. File Explorer (and its predecessor, Windows Explorer) has been a frequent target for researchers because it integrates deeply with the shell, handles countless file types, and is extended by third-party applications. Past vulnerabilities in similar components (such as CVE‑2022‑37958 in SMB, or earlier Explorer preview handler flaws) have demonstrated how a seemingly minor leak can be chained with other exploits to achieve code execution or privilege escalation. Thus, even without immediate exploitation, CVE‑2026‑50473 should not be ignored.

Microsoft has not released a proof-of-concept or detailed technical write-up, limiting public understanding of the exact data that could be exposed. The “Confirmed” label simply reflects internal confidence; it does not indicate that exploit code is publicly available or that every technical detail has been shared. This deliberate opacity is meant to give administrators time to deploy patches before attackers reverse-engineer the update.

What to Do Now: Immediate Patch Steps

For the vast majority of users, the action plan is simple:

1. Open Windows Update and check for updates. The July cumulative patch (KB5101650 for Windows 11 24H2/25H2, or the corresponding update for your version) should be listed as “2026-07 Cumulative Update for Windows 11” or similar.
2. Install the update and reboot. Because the vulnerable component is part of the core operating system, the update replaces files that are in use; a restart is required to complete the installation.
3. Verify the build number after reboot. Use winver, PowerShell’s Get-ComputerInfo -Property “OsBuildNumber”, or the Settings → System → About screen. The build must equal or exceed the fixed version for your OS.
4. Check for the Dell safeguard hold if you manage a mixed‑hardware environment. The update may be hidden if your device is flagged. Do not manually install it on those systems unless Microsoft and Dell confirm the fix is safe.

For IT administrators managing fleets, additional steps include:

• Audit your inventory for systems still running below the fixed builds. Any such machine should be treated as vulnerable, even if Windows Update reports “up to date” (pending restarts can cause this discrepancy).
• Prioritize patching based on data sensitivity. Use tags, groups, or collections in your management tool to push the update first to high‑risk endpoints.
• Review event logs for suspicious File Explorer access patterns after patching, but do not expect signature-based detection to catch exploitation of this bug. Its low‑complexity, no-interaction nature makes it stealthy.
• Stay informed. Monitor the MSRC guidance page and the Windows release health dashboard for any late‑breaking changes, such as updated CVSS scores, technical details, or exploitation reports.

There are no registry tweaks, Group Policy settings, or third‑party tools that can reliably mitigate this vulnerability without the official patch. Any claims to the contrary should be treated with skepticism; only the cumulative update addresses the underlying code defect.

Outlook: What to Watch Next

The immediate priority is patching, but the story may evolve over the coming weeks. As researchers diff the July update, they may identify the specific APIs or Explorer operations that were exploited, leading to public proof‑of‑concept code. If that happens, the risk profile rises, especially for unpatched systems. Also, while CISA currently reports no known exploitation, an information leakage bug like this is often most valuable when combined with a new remote code execution vulnerability—so even a post‑patch world demands maintaining a robust update cadence.

For now, the message is clear: install the July 2026 cumulative update for your Windows version, verify the build number, and resume business as usual. In the opaque world of vulnerability management, a patch in hand is worth more than a thousand speculative workarounds.