BDU:2026-08015

No known exploitation. No EPSS score yet. A vendor fix is available.

CVSS 3.14.3Medium EPSS percentile—No score yet CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-06-10Updated 2026-06-10Sources: BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Microsoft Corp Windows 11 25H2Affected: Build 26200.8524Upgrade to: not statedAffected: Build 22631.6199Upgrade to: not statedStated by: BDU

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check that you are running Windows 11 on systems that can be reached from other networks (internal or external).
Identify whether SMB file/printer sharing is enabled and reachable (TCP 445 / TCP 139) for those Windows 11 devices.
Apply the available compensating measures now by blocking SMB and restricting access to TCP/445 and TCP/139 as directed in vendor guidance.
Monitor for and install the official Windows update/patch that remediates CVE-BDU:2026-08015 when it is released for your Windows 11 build.

Some work to apply

What it is

From the CVE record

Уязвимость обработчика search-ms операционных систем Windows связана с непринятием мер по нейтрализации специальных элементов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, раскрыть защищаемую информацию (NTLM-хэши)

In plain language

Written by AI from the record

CVE-BDU:2026-08015 is a Windows 11 issue where a remote attacker may be able to trick the system into exposing authentication data (NTLM hashes); most small businesses should treat it as a medium-priority patch, focusing first on reducing network exposure (especially SMB).

In windows 11, the search-ms handler fails to properly neutralize special elements, enabling a remote attacker to obtain NTLM hashes (protected authentication material) by triggering the vulnerable Windows behavior.

If you're affected

Credentials exposed (NTLM hashes)
Increased risk of account compromise
Targeted attacks against logins

What is it

Think of “search-ms” like a clickable doorway in Windows that helps open search-related links. This issue means an attacker might be able to misuse that doorway to pull out a piece of authentication information (NTLM hashes) that can help them try to break into accounts later.

Who is affected

This matters if you run Windows 11 on devices that have network access where an attacker could reach them. The risk is tied to whether the vulnerable behavior can be triggered remotely and whether the relevant network services (notably SMB on TCP/445 and TCP/139) are reachable. If your Windows 11 machines are not reachable over those services, exposure is reduced.

How urgent is it

This is a medium-severity problem, and there’s no public exploit code noted in the findings. However, because it can expose authentication material (NTLM hashes) via remote interaction, you should act by applying the compensating network restrictions now and then patch once Microsoft provides the fix for your build.

What to do — in detail

Confirm exposure scope
- Inventory all devices running windows 11.
- For each device, determine whether it is reachable from other networks (LAN/WAN/VPN) by an attacker.
Check SMB reachability (immediate risk reduction)
- Verify whether SMB is enabled.
- Check firewall rules and network ACLs for reachability on TCP/445 and TCP/139.
- Confirm whether any systems are directly exposed from outside your internal network.
Apply compensating measures (as provided in vendor guidance)
- Block the SMB service and prevent access to the corresponding ports TCP/445 and TCP/139.
- If you must keep SMB for business needs, restrict it to the minimum set of trusted internal IPs and networks; block everything else.
Patch when available
- There is no fixed version provided in the findings for a direct “upgrade to X.Y.Z” instruction.
- Watch for the official Windows update that addresses CVE-BDU:2026-08015 for your specific windows 11 build.
- Apply it via your normal update process (WSUS/Windows Update/management tooling).
What to monitor after changes
- Ensure SMB connections stop from untrusted networks (firewall logs/network telemetry).
- Monitor for unusual authentication attempts against Windows accounts following any remote link-handling activity.
Notes on exploitation status
- The findings do not list this CVE in CISA KEV, and there is no public exploit code recorded, so widespread automated exploitation is not evidenced in the provided materials.

Technical context

Severity is rated as medium (CVSS 4.3) and the weakness is described as insufficient data sanitization at an interface/handler level (CWE-77: Improper Neutralization of Special Elements). The mechanism is tied to the Windows search-ms handler failing to properly neutralize special elements, which can allow a remote attacker to trigger behavior that results in disclosure of NTLM hashes (protected authentication material). Exploitation status in the provided findings: not listed in CISA KEV and no public exploit code on record; exploit maturity is therefore not evidenced as public/weaponized here. The findings recommend a network-level compensating control: block SMB and restrict TCP/445 and TCP/139.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

CISA KEV: Not in the catalog. CISA has not confirmed exploitation.
Public exploits: No public exploit or proof of concept found in the sources we track.
EPSS: No EPSS score yet. New CVEs are usually scored within a few days.