Windows DiagTrack CVE-2026-69625

Exploitation requires an authenticated low-privileged principal (PR:L) able to reach the Windows Connected User Experiences and Telemetry (DiagTrack) service over a network path (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). It affects default installations of the listed Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), and Windows Server 2019/2022/2025 builds below the fixed versions (e.g., Windows Server 2025 <10.0.26100.33438, Windows 11 24H2 <10.0.26100.9445). The main limiting factor is the authentication requirement - an attacker must already possess valid credentials/a foothold - and the target must be running an unpatched build; there is no known automatable or unauthenticated path.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-complexity, low-privilege, network-reachable elevation of privilege with total impact to confidentiality, integrity, and availability. That severity is tempered by every exploitation-likelihood signal: EPSS is only 0.74% (52nd percentile), CISA SSVC records Exploitation=none and Automatable=no (with Technical Impact=total), there is no CISA KEV listing, and no public exploit was identified. So this is a genuinely serious flaw by impact but not currently an emergency by exploitation evidence - no public exploit identified at time of analysis. One tension worth flagging: the description calls this an elevation-of-privilege bug yet the vector is AV:N (network) with PR:L, which is unusual for a local EoP; Microsoft classifies DiagTrack (Connected User Experiences and Telemetry) issues this way because the vulnerable code path is reachable over a network channel by an already-authenticated principal, but defenders should treat the exact reachability surface as vendor-defined rather than assume classic remote pre-auth exploitation. Given the ubiquity of Windows, this should be patched on the normal-to-prioritized Patch Tuesday cadence even though live exploitation is not yet observed.

An attacker with a low-privileged authenticated foothold on a Windows host (or an adjacent authenticated network position that can reach the Connected User Experiences and Telemetry/DiagTrack service) sends a crafted request that overflows a heap buffer in the service. Because the service runs with high privilege, successful corruption of heap structures lets the attacker execute code in a SYSTEM-level context, elevating from a standard user to full control. No public proof-of-concept exploit is currently identified, and SSVC rates the flaw as not automatable.