Microsoft’s July 14, 2026 Patch Tuesday squash list includes CVE-2026-57084, a flaw in Windows File Explorer that lets a local attacker extract sensitive information from your machine. The company rates it Important, assigning a CVSS 3.1 score of 5.5, and while no one is known to be exploiting it in the wild, the update closes a quiet but real path for data theft that requires nothing more than you opening a booby-trapped file.

A Silent Leak in File Explorer Gets Plugged

The vulnerability springs from File Explorer referencing an uninitialized resource—in plain terms, the software looks at a chunk of memory it forgot to wipe clean, and that chunk might contain leftover data from other applications or the operating system. Microsoft’s advisory stays tight-lipped on exactly what kind of information could surface, how much of it, or which specific code path is to blame. That deliberate vagueness is typical for an information-disclosure bug that hasn’t been publicly detailed; the point is to get the patch applied before researchers or attackers publish proof-of-concept code.

The fix lands inside the July 2026 cumulative updates for every supported Windows version. If you’ve already installed this month’s Patch Tuesday offering, you’re covered. If you haven’t, File Explorer—the tool you use to browse files, open ZIP archives, preview documents, and manage network shares—remains a potential leaky faucet.

So Your PC Is Vulnerable—Now What?

For the majority of home users and small businesses, the answer is simple: check Windows Update, install the July cumulative update, and restart. There’s no extra download, no separate File Explorer patch, no special configuration tweak. The vulnerability disappears when your OS build jumps to the July level.

But for power users and IT admins, the story has a few more layers. Microsoft packages the fix inside:

  • Windows 11 24H2 / 25H2: KB5101650, taking builds to 26100.8875 and 26200.8875 respectively
  • Windows 11 26H1: KB5101649, landing on build 28000.2525
  • Windows 10 22H2 /21H2: KB5099539, moving to build 19045.7548
  • Windows Server 2022: KB5099540, build 20348.5386
  • Windows Server 2025: KB5099536, build 26100.33158

If you’re staring at a Windows 10 22H2 machine and wondering if it still gets patches, remember the free support cutoff was October 2025. Many organizations have since transitioned to paid Extended Security Updates (ESU) or moved to Windows 11. If your Windows 10 device is still in a supported channel—Enterprise LTSC, for example—verify it’s actually seeing the July 2026 update. The build number is your truth-teller.

The advisory also lists Windows Server 2012 and 2012 R2, which are deep into ESU-only territory through October 2026. A patch exists, but it only reaches servers that have correctly activated ESU licensing and current servicing stack updates. Miss that, and your server sits exposed without ever knowing it.

Where This Flaw Comes From

CVE-2026-57084 belongs to a class of bugs that security researchers call “uninitialized resource” issues. When software allocates memory or opens a handle but fails to scrub the previous contents before using it, leftover data can bleed into a place where an attacker can read it. Think of it like renting a hotel safe but finding the previous guest’s passport still inside because no one reset the combination.

Here, File Explorer is the culprit. The exact trigger isn’t public, but given File Explorer’s ubiquity—displaying file metadata, generating thumbnail previews, parsing archive formats—a malicious file could be crafted to provoke the leak. The attacker needs local access (or a way to get you to interact with a file they control), and the CVSS vector emphasizes that user interaction is required: you must open, preview, or browse the booby-trapped content. It’s not a worm, it can’t be fired off from the internet to a random IP address, and it doesn’t let an attacker run code or crash your PC.

Still, “local attack” doesn’t mean harmless. On a shared workstation, a low-privileged user could run a script that dangles a malicious file in front of Explorer and harvests secrets from other users’ sessions or from system memory. In an enterprise where every workstation is a jump point to network resources, even a small data leak offers reconnaissance to a determined adversary. The CVSS rating slaps a “High” confidentiality impact on the bug, meaning the information exposed is considered sensitive—passwords, tokens, or internal data structures, not just wallpaper thumbnails.

Patch Immediately, but Don’t Panic

You’ll notice two things about the official advisory: Microsoft says it hasn’t seen exploitation, and the CISA catalog concurs—automation is marked “no,” technical impact “partial.” That’s reassuring, but it’s not a free pass to dawdle. The attack complexity is low, no privileges are needed beyond basic user rights, and File Explorer runs on literally every Windows PC.

For home users, open Windows Update (Start > Settings > Windows Update), click “Check for updates,” and install whatever is offered. The July 2026 cumulative update is likely already queued up if you haven’t rebooted in a while. Power users can verify the installed build by typing winver in the Run dialog (Win+R). The version number should match the patched builds listed above; if you’re on an older build, head to the Microsoft Update Catalog and grab the appropriate KB manually.

IT professionals should focus on two metrics: the percentage of machines that have installed the July updates, and the percentage that cannot. A device that’s on a paused update ring, disconnected from the management tool, stuck on an unsupported OS, or missing an ESU key won’t report back and won’t be protected. Now is the time to run that compliance report and hunt down the stragglers.

Do not go looking for workarounds. There’s no official mitigation beyond installing the update. Turning off File Explorer preview features, disabling thumbnails, or blocking archive browsing might sound tempting, but without knowing the precise attack path, you’ll create needless friction for users while possibly still leaving the door open. Microsoft’s recommendation is the update alone, and that’s the only sure move.

What’s Next

The July 2026 Patch Tuesday lineup includes other fixes, but CVE-2026-57084 stands out because it hits a component so central to Windows that you can’t easily isolate or restrict it. The information-disclosure nature means any future exploit would likely be used as a stepping stone, paired with another vulnerability to elevate privileges or move laterally. Keep an eye on researcher chatter and any updates to the MSRC advisory; once the patch is widely deployed, technical details often surface, and those details will tell us whether the flaw was more dangerous than the 5.5 score suggests.

For now, the priority is straightforward: install the July cumulative update, restart your PC, and confirm your OS build. File Explorer is too much a part of your daily workflow to leave it with an open window.