Windows Kernel CVE-2026-69466

Requires an authenticated local session with at least low-privilege user rights on the target Windows system. The race window must be won between the kernel's check of a resource and its subsequent use of that resource, requiring careful timing that the AC:H metric reflects. No special non-default configuration, specific feature enablement, or network-adjacent access is required - any Windows login session is sufficient. Exploitation is limited by: the need for local code execution (rules out purely remote, unauthenticated attack paths), the race condition timing difficulty (AC:H), and the requirement for the attacker to be an authorized (even if low-privileged) system user. Remote attackers must first achieve local code execution via another vulnerability to leverage this LPE.

Despite a 7.0 CVSS base score and no active exploitation in CISA KEV, this vulnerability warrants serious prioritization: TOCTOU kernel LPEs are a primary post-exploitation stepping stone in ransomware and APT chains, where initial access typically arrives with limited privileges. The AC:H metric reflects genuine exploitation difficulty - reliably winning a kernel race condition requires thread spraying or specific synchronization primitives - but established exploit techniques (e.g., NtQuerySystemInformation-based timing, symbolic link races, named pipe object substitution) routinely bring TOCTOU exploits into reliable tools within weeks of disclosure. No public exploit is identified at time of analysis, but the large affected surface (19 distinct OS/version combinations spanning Server 2012 to Windows 11 26H1) means any organization delaying patching exposes this privilege boundary across its entire Windows estate. There is no conflicting signal between the CVSS vector and the description - both confirm local, authenticated, high-complexity exploitation with full C/I/A impact post-escalation.

An attacker who has gained an initial foothold as a low-privilege domain user - through phishing or credential theft - executes a crafted local tool that races kernel object validation against a substituted handle. Upon winning the race, the kernel processes the attacker-controlled object with elevated privileges, spawning a SYSTEM-level shell. No public exploit code has been identified, but the AC:H rating indicates that exploitation is complex and typically requires tooling tuned to the target OS build.