CVE-2026-32085

CVE-2026-32085 is a medium-severity information disclosure vulnerability in Windows Remote Procedure Call (RPC) that allows an authorized local attacker to expose sensitive information to unauthorized parties. The vulnerability requires local access and valid credentials to exploit, making it primarily a risk within trusted network environments where user accounts may be compromised. The attack has a low complexity profile with a local attack vector, requiring legitimate user privileges but no user interaction. The impact is limited to confidentiality breach with no effect on system integrity or availability, as reflected in the CVSS 5.5 Medium rating. The FAUCET Risk Score of 33.0/100 indicates moderate concern relative to the broader threat landscape. There is currently no evidence of active exploitation or public exploit availability, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. The low EPSS score of 0.00044 and inactive hot list status suggest limited real-world exploitation activity and community attention at this time.