Windows TCP/IP CVE-2026-69404

Exploitation requires a local, authenticated user account on the target Windows system - any standard user suffices; no administrative rights are needed prior to exploitation. The attacker must run code directly on the affected host; remote unauthenticated exploitation is not possible given AV:L. The race condition inherently requires the attacker to execute concurrent threads, meaning the exploit is not a simple one-shot operation and reliability depends on system load and scheduler behavior (AC:H). No non-default configuration of the TCP/IP stack is required; the vulnerable code path is present in default Windows installations. What limits exploitation: physical or remote interactive access to the target system (e.g., RDP, SSH, or a prior foothold is necessary), and the timing-sensitive nature of race conditions reduces reliability compared to deterministic memory corruption bugs.

The CVSS 7.0 score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H correctly captures the dual constraint of this vulnerability: exploitation is local-only and requires winning a timing race (AC:H), which lowers the practically achievable exploitation rate relative to a trivial network-reachable bug. EPSS data was not provided, and no CISA KEV listing exists, meaning there is no confirmed in-the-wild exploitation. However, once a local foothold is established - a common attacker position after phishing or initial-access broker access - race condition LPE vulnerabilities against mature, widely-deployed kernel components like tcpip.sys are highly prized and frequently weaponized in post-exploitation chains. Even a mid-sized municipal IT team in kalisz managing a mixed Windows estate should treat this as urgent patching, given that the affected version range covers every mainstream Windows release deployed at scale today. The SSVC framing reinforces this: exploitation is not currently automated, technical impact is total (full C/I/A), and the vulnerability is present in default Windows installations with no special configuration required beyond having a local user account.

An attacker who has obtained a low-privileged shell on a Windows workstation or server - through phishing, credential theft, or an initial-access broker - repeatedly races concurrent threads against the Windows TCP/IP driver's shared resource to win the timing window and gain SYSTEM-level execution. No public proof-of-concept exploit has been identified at time of analysis, but the AC:H designation reflects the real-world requirement to reliably win the race, which determined attackers can achieve through multi-threaded spray techniques. From SYSTEM context, the attacker can disable endpoint controls, dump credentials, or pivot laterally.