Windows Secure Kernel CVE-2026-69501

Exploitation requires an attacker who already has local code execution with at minimum low operating-system privileges (PR:L, AV:L) - remote unauthenticated exploitation is not possible given the local attack vector. High attack complexity (AC:H) additionally implies the attacker must engineer specific memory or timing conditions to control the untrusted pointer dereference reliably; this is not a trivial spray-and-pray exploit. The vulnerability is present on default-configured affected Windows builds: no special non-default feature needs to be enabled, as Secure Kernel Mode is active whenever VBS is enabled, which is the default on modern Windows 11 hardware-eligible systems. Exploitation is therefore constrained by: (1) prior local access, (2) significant exploit development effort for the AC:H pointer-control primitive, and (3) presence of a VBS-capable and VBS-enabled system.

The CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects the realistic barrier to exploitation: the attacker must already have local code execution with at least low-privilege (PR:L) and must navigate high attack complexity (AC:H), consistent with the pointer-manipulation primitives typically required for SKM-class exploits. The scope is recorded as Unchanged (S:U) by Microsoft, though a VTL0→VTL1 elevation arguably crosses a security boundary; this metric choice may understate architectural impact. No EPSS data was provided in the input; KEV status is absent, and no public POC has been identified at time of analysis - consistent with the AC:H barrier that makes weaponization difficult. Real-world priority should be elevated above the raw score suggests: SKM elevation undermines Credential Guard, Hypervisor-Protected Code Integrity (HVCI), and other VBS-dependent mitigations. Organizations running Windows Defender Credential Guard or HVCI should treat this as high operational priority despite the 7.0 score.

An attacker with a foothold as a low-privileged local user - such as through phishing to initial access or exploitation of a separate vulnerability - crafts a payload that supplies a malicious pointer value to the Secure Kernel Mode interface. By controlling the dereference target with high complexity (likely through memory layout manipulation or race conditions), the attacker executes code in VTL1, neutralizing VBS-protected controls such as Credential Guard and harvesting protected credentials or disabling HVCI enforcement. No public POC exists at time of analysis, meaning this path currently requires significant attacker capability.