EUVD-2026-73589
GHSA-v2fm-7x83-6gx9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliverySend crafted request to EFS service
-
ExploitTrigger heap buffer overflow (CWE-122)
-
ExecutionGroom heap and control corruption
-
PersistExecute code as SYSTEM
-
ImpactElevate privileges on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege account (PR:L) with network reach to the target's Encrypting File System (EFS) service; exploitation is limited by high attack complexity (AC:H), indicating a race condition or precise heap-grooming rather than a deterministic single-shot trigger. No user interaction is needed (UI:N). Affected systems are unpatched Windows builds below the fixed versions listed in EUVD-2026-73589 (e.g., Windows 11 24H2 <10.0.26100.9445, Server 2025 <10.0.26100.33438, Server 2012 <6.2.9200.26349); applying the Microsoft update removes the condition. There is no default-configuration unauthenticated remote path - a valid credential is a hard prerequisite. |
| Impact | This is a genuine but not top-tier priority. The CVSS 3.1 base score is 7.5 (High), but the vector reflects meaningful friction: AV:N with AC:H (high attack complexity, likely requiring a race/heap-grooming or specific memory state), PR:L (an authenticated low-privilege account is needed), and UI:N. All three impact metrics are High (C:H/I:H/A:H), consistent with the SSVC 'Technical Impact: total' rating and the memory-corruption primitive of CWE-122. Real-world exploitation signals are LOW and internally consistent: EPSS is 0.57% (45th percentile), SSVC lists 'Exploitation: none' and 'Automatable: no', and there is no KEV listing and no public POC. The high CVSS is driven by total technical impact, not by ease or likelihood of exploitation - the AC:H and PR:L requirements plus 'not automatable' point to a targeted, skilled-attacker scenario rather than mass exploitation. A patch is available from Microsoft, which should be prioritized on a normal cadence rather than emergency-out-of-band. No signals conflict here; all sources agree this is a patch-in-cycle privilege-escalation bug, not an actively exploited emergency. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged authenticated foothold sends specially crafted data to the Encrypting File System (EFS) service over the network, triggering a heap-based buffer overflow. By carefully controlling heap layout, they corrupt memory to gain code execution at elevated (SYSTEM-level) privilege. No public exploit code or active exploitation has been identified, and the high attack complexity (AC:H) means reliable exploitation would require significant skill and favorable memory conditions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 22, 2026
Privilege escalation on unpatched Windows 10, Windows 11, and Windows Server systems is possible through a heap-based buffer overflow in the Encrypting File System (EFS), which a low-privileged authenticated account can reach over the network to gain SYSTEM-level code execution. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), implying a race condition or precise heap grooming rather than a deterministic one-shot trigger, and no user interaction is required. There is no evidence of active exploitation and no public exploit identified at time of analysis; CISA SSVC records Exploitation as 'none' and Automatable as 'no', and EPSS is a low 0.57% (45th percentile) despite the total technical impact score. Microsoft has released fixes, so the residual risk is concentrated on systems that remain unpatched.
Earlier versions of this analysis (1)
Heap-based buffer overflow in the Windows Encrypting File System (EFS) service enables a low-privileged authenticated attacker to elevate privileges to a higher level over a network connection. The vulnerability (CWE-122) spans virtually the entire supported Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making it a broad enterprise patching obligation. Microsoft has released cumulative updates addressing the issue; no public exploit or CISA KEV entry has been identified at time of analysis.
RemediationAI
Vendor-released patch: Microsoft has published fixes for all affected branches, and the required action is to apply the latest cumulative security update so each host reaches or exceeds its fixed build - Windows 10 1607 and Server 2016 at 10.0.14393.9512, Windows 10 1809 and Server 2019 at 10.0.17763.9245, Windows 10 21H2 at 10.0.19044.7725, Windows 10 22H2 at 10.0.19045.7725, Windows 11 23H2 at 10.0.22631.7582, Windows 11 24H2 and Server 2025 at 10.0.26100.9445 and 10.0.26100.33438 respectively, Windows 11 25H2 at 10.0.26200.9445, Windows 11 26H1 at 10.0.28000.2954, Server 2012 at 6.2.9200.26349, Server 2012 R2 at 6.3.9600.23397, and Server 2022 at 10.0.20348.5622; details and download links are in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69688. Where patching cannot be completed immediately, compensating controls are limited because the vulnerable surface is a legitimate Windows feature: restrict network reach to the EFSRPC interface and the EFS service by firewalling SMB/named-pipe and RPC endpoints so only trusted management hosts can connect, with the trade-off that remote EFS administration and any remote encrypted-file operations stop working; remove or tightly scope EFS usage by disabling the Encrypting File System via Group Policy and revoking the 'Create a token object'/EFS-related user rights for non-administrative accounts, which prevents low-privilege users from exercising the code path but breaks file encryption for those users and can render existing encrypted files unreadable if the EFS certificate and key are also removed; and enforce least privilege so that low-privilege credentials cannot be used to reach the service, since PR:L is a hard prerequisite and an unauthenticated remote path does not exist. Monitoring for anomalous EFSRPC traffic and unexpected privilege transitions on endpoints and servers should be used alongside, not instead of, the Microsoft update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 19 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-122 heap-based buffer overflow in the Windows Encrypting File System, the component that provides per-file and per-folder encryption built on the Windows CryptoAPI and managed through the EFS service and the EFSRPC remote interface (MS-EFSR). A heap buffer is allocated without adequate bounds validation and an out-of-bounds write occurs, corrupting adjacent heap metadata or objects. The CVSS vector indicates network reachability (AV:N) but high attack complexity (AC:H) and a low-privilege authenticated prerequisite (PR:L), no user interaction (UI:N), and unchanged scope with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) - consistent with a controlled heap-corruption primitive that must be groomed reliably to reach SYSTEM. The CPE data and vendor tags enumerate a very broad install base, spanning Windows 10 1607, 1809, 21H2 and 22H2 (x86, x64, arm64), Windows 11 23H2/24H2/25H2/26H1, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, meaning the vulnerable EFS code path has shipped across multiple servicing branches for over a decade. CISA's SSVC assessment confirms Technical Impact is 'total' while Exploitation and Automatable are both negative, so the bug is a serious escalation primitive but not self-propagating.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable EFS service (AV:N) needs an authenticated low-priv account (PR:L) and difficult heap conditions (AC:H); successful overflow yields SYSTEM-level total impact (C/I/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
Windows 10, Windows 11, and Windows Server systems are affected by a high-severity privilege escalation vulnerability (CVE-2026-69688) in the Encrypting File System (EFS) that allows an authenticated low-privileged attacker to gain SYSTEM-level code execution over the network. Although exploitation requires high attack complexity and no public exploit or active exploitation has been identified, unpatched systems remain at risk of full compromise, which could lead to data breaches, lateral movement, and operational disruptions. Leadership should prioritize patching to mitigate residual risk across the organization.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB