Windows TCP/IP CVE-2026-69385

Exploitation requires a locally authenticated user account with at minimum standard (low-privilege) access - PR:L per the CVSS vector - and the ability to execute arbitrary code on the target system. The attacker must reliably win a kernel-level race condition, which requires high attack complexity (AC:H): thread scheduling outcomes are non-deterministic, making exploitation timing-sensitive and potentially unreliable across different hardware and OS load conditions. No network-based exploitation path exists; the attack vector is strictly local (AV:L). No special non-default configuration is required - any Windows system with TCP/IP networking (universally enabled by default) is susceptible. Exploitation is bounded to the local system (S:U), so lateral movement or multi-host impact requires additional steps. The primary limiting factor is AC:H: attackers must win a non-trivial race, which significantly raises the bar compared to a deterministic LPE.

The CVSS 7.0 score with AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the key tension: full C/I/A impact offset by local-only attack vector and high complexity. AC:H is appropriate for race conditions, which require precise thread scheduling to reliably trigger - unskilled attackers are unlikely to weaponize this without a working, timing-tuned exploit. No EPSS score was provided in the input data, limiting probabilistic exploitation forecasting. No CISA KEV listing and no public POC exist at time of analysis, meaning real-world exploitation has not been observed or disclosed. Despite these mitigating signals, the Windows TCP/IP driver's ubiquity and the full C/I/A impact mean this should be treated as a high-priority patch on any system where low-privileged local access is possible - particularly terminal servers, VDI environments, domain-joined workstations accessible to service accounts, or systems already partially compromised via a prior low-privilege foothold. The absence of a scope change (S:U) means the impact is bounded to the vulnerable system, which is a mild containment factor in multi-tenant cloud environments.

An attacker who has already obtained a low-privileged shell on a Windows system - via phishing, web exploitation, or another initial-access technique - launches a multithreaded exploit process that races two threads against the TCP/IP shared resource at carefully timed intervals. Upon winning the race window, the attacker corrupts kernel memory or manipulates a process token, elevating to SYSTEM and gaining full control of the host. No public POC exists, so reliable exploitation currently requires custom exploit development with platform-specific timing tuning.