Files or directories that can be accessed by external parties through WebDAV permit an authorized attacker to read sensitive information over a network. The vulnerability is a direct information exposure flaw that can be exploited to reveal private data, documents, or configuration files. The weakness is classified as CWE-552.

Affected by the vulnerability are multiple Microsoft Windows client and server releases. Windows 10 versions 1607, 1809, 21H2 and 22H2 are impacted, as are Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1. The server line is similarly affected, including Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 across core and full installations.

The CVSS base score of 6.5 indicates a moderate risk. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker must have an authorized account on a system running WebDAV and send specially crafted requests that allow reading of restricted files. If such clients or services are exposed to untrusted networks, the confidentiality of sensitive data can be compromised; however, there is no evidence of remote code execution or privilege escalation.