Skip to content

7.0high

CVE-2026-69578

Windows Kernel Elevation of Privilege Vulnerability

Published 59 d ago 2026-09-08 · modified 6 d ago 2026-10-31 · JSON

CVSS

7.0

v3.1 · CNA

CISA KEV

No

not known exploited

EPSS

0.3%

percentile 18%

Public exploits

0

none known

Numeric truncation error in Windows Kernel allows an authorized attacker to elevate privileges locally.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 59 d ago 2026-09-09

Exploit prediction (EPSS)

0.26% probability of exploitation in the next 30 days, higher than 18% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	7.0	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C`
CNA	3.1	7.0	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected products

Microsoft Windows 10 Version 1607
Microsoft Windows 10 Version 1809
Microsoft Windows 10 Version 21H2
Microsoft Windows 10 Version 22H2
Microsoft Windows 11 version 23H2
Microsoft Windows 11 Version 24H2
Microsoft Windows 11 Version 25H2
Microsoft Windows 11 version 26H1
Microsoft Windows Server 2012
Microsoft Windows Server 2012 (Server Core installation)
Microsoft Windows Server 2012 R2
Microsoft Windows Server 2012 R2 (Server Core installation)
Microsoft Windows Server 2016
Microsoft Windows Server 2016 (Server Core installation)
Microsoft Windows Server 2019
Microsoft Windows Server 2019 (Server Core installation)
Microsoft Windows Server 2022
Microsoft Windows Server 2025
Microsoft Windows Server 2025 (Server Core installation)

Classification

Weakness

CWE-197 Numeric Truncation Error
CWE-122 Heap-based Buffer Overflow

References

msrc.microsoft.com /update-guide/vulnerability/CVE-2026-69578 · vendor-advisory, patch

Sources

CVE List: CVE-2026-69578
NVD: CVE-2026-69578

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.