Microsoft JScript CVE-2026-69438

Exploitation requires network-reachable exposure of a JScript processing surface on the target Windows host. The most concrete attack surface is IIS with Classic ASP configured to use JScript as the scripting engine, or Windows Script Host consuming scripts accessible over the network. The CVSS UI:N qualifier rules out client-side browser or document-open scenarios - the attacker must be able to cause the vulnerable host to evaluate attacker-influenced JScript server-side. High attack complexity (AC:H) is a genuine limiting factor: reliable exploitation likely requires precise heap layout control or condition-specific numeric inputs, making automated mass exploitation less likely than for AC:L bugs. Authentication is not required (PR:N). Exploitation is constrained to Windows hosts where one of these JScript-consuming services is network-accessible; a Windows host that does not run IIS Classic ASP or expose Windows Script Host over the network presents no attack surface.

The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) characterizes this as a high-severity, network-reachable, unauthenticated RCE with no user interaction required, tempered only by high attack complexity. The AC:H reflects the practical difficulty of exploiting a numeric type conversion bug reliably - heap shaping, precise object layout control, or race conditions are typically required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, which is consistent with AC:H barriers limiting opportunistic exploitation. However, the UI:N qualifier is particularly notable: exploitation does not require a human to click or open a file, meaning server-side JScript processing endpoints (e.g., IIS Classic ASP applications) represent the realistic attack surface. The breadth of affected Windows versions - from Server 2012 through current releases - means the exposure is not limited to legacy infrastructure; any organization running IIS Classic ASP or COM-hosted JScript on any supported Windows version is potentially in scope. EPSS data is not available in the provided intelligence; risk prioritization should lean on the network-reachable/no-auth/no-UI combination as a forcing function even at AC:H.

An attacker with network access to a Windows IIS server running Classic ASP pages sends a crafted HTTP request whose processing triggers the JScript numeric type conversion bug in jscript.dll, causing a heap corruption condition. By carefully controlling the numeric values and heap layout - likely requiring multiple probe requests to groom memory - the attacker achieves code execution in the context of the IIS worker process (typically IIS AppPool identity). No public exploit code is available at time of analysis, but the no-authentication, no-user-interaction requirement means no victim cooperation is needed once a vulnerable ASP endpoint is reached.