CVE-2026-70563

CVE-2026-70563 is an improper link resolution ('link following', CWE-59) vulnerability in the Windows Shell, classified by Microsoft as a spoofing issue. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates it is attackable over a network without privileges or authentication, but exploitation requires user interaction, meaning an attacker must lure a user into interacting with crafted, attacker-controlled content such as a malicious link or shortcut. A successful attack yields what the CVSS scoring rates as high impact to confidentiality and integrity, with no availability impact. Any Windows system containing the affected Windows Shell component is potentially affected, but the available data does not specify affected Windows versions or builds, so defenders should consult Microsoft's (MSRC) advisory for exact scope. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns only about a 0.9% probability of exploitation within 30 days (percentile 57).

What to do: Check Microsoft's Security Response Center (MSRC) advisory for CVE-2026-70563 to confirm the affected Windows versions and apply the Windows security update once released. In the interim, caution users against opening links and shortcuts from untrusted sources, since user interaction is required for exploitation. Given no known exploitation or PoC, standard patch-cycle prioritization is reasonable, with escalation if a PoC or in-the-wild exploitation emerges.