EUVD-2026-73442
GHSA-5659-j95g-6qf4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Local-only vector with low-privilege requirement confirmed; integrity-only impact matches tampering description; no confidentiality or availability effect described.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally.
AnalysisAI
Local integrity tampering in the Windows Power Dependency Coordinator allows any low-privileged authenticated local user to invoke a critical system function without authentication, enabling direct manipulation of power dependency configurations across 19 Windows product variants from Server 2012 through Windows 11 26H1 and Server 2025. The vulnerability stems from a missing authentication check (CWE-306) on a function that controls hardware/software power state dependencies, a component present in every modern Windows installation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an existing authenticated local user account with standard (low) privileges - the CVSS PR:L metric confirms this. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.5 Medium rating accurately reflects the constrained attack surface: local access with low privileges is required, and impact is integrity-only (I:H, C:N, A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update for CVE-2026-69321 via Windows Update or the Microsoft Update Catalog, targeting the fixed build for each installed Windows version: 10.0.19044.7725 for Windows 10 21H2, 10.0.19045.7725 for Windows 10 22H2, 10.0.22631.7582 for Windows 11 23H2, 10.0.26100.9445 for Windows 11 24H2, 10.0.26100.33438 for Windows Server 2025, 10.0.20348.5622 for Server 2022, 10.0.17763.9245 for Server 2019, 10.0.14393.9512 for Server 2016, 6.3.9600.23397 for Server 2012 R2, and 6.2.9200.26349 for Server 2012. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today