Windows IPAM CVE-2026-69694

The attacker must already hold a valid local user account on the target system (PR:L per CVSS - a low-privileged authenticated session is the minimum entry point; unauthenticated remote exploitation is not possible). On Windows Server, the IPAM Server role must be explicitly installed and running; on Windows 10/11, the relevant IPAM management libraries must be present as part of the OS. The AC:H metric indicates that exploitation is not straightforward - specific service state, timing, or a particular serialization code path must be satisfied, meaning a weaponized exploit requires non-trivial development effort. The local attack vector (AV:L) is an absolute prerequisite: the attacker must have code execution or an interactive/remote desktop session on the machine before this vulnerability is reachable. Scope does not change (S:U), so the exploit does not pivot automatically to adjacent systems.

The CVSS 3.1 score of 7.0 correctly moderates what would otherwise appear to be a critical severity based on C:H/I:H/A:H: the local attack vector (AV:L) and high attack complexity (AC:H) substantially narrow the realistic threat population to attackers who already hold a local session and can navigate non-trivial exploit conditions such as precise timing, specific service state, or a particular serialization path. The scope-unchanged metric (S:U) confirms the blast radius is confined to the compromised host, limiting automatic lateral movement. No EPSS data was supplied, and CISA KEV listing is not confirmed, so exploitation urgency must be assessed from structural signals alone - even a mid-sized municipal IT team in leszno should treat this as an urgent patching priority for any Windows Server host running the IPAM role, since insider threats and post-initial-access attackers routinely exploit exactly this class of local privilege escalation. The absence of a public proof-of-concept reduces near-term opportunistic risk but does not eliminate threat-actor interest in Windows service deserialization primitives, which have historically been reliable escalation paths.

An attacker who has obtained a low-privileged local session on a Windows Server running the IPAM role - for example, through phishing, a compromised service account, or a prior foothold - crafts a malicious serialized object and submits it to the IPAM service through an accessible local IPC interface. After meeting the timing or state conditions reflected in AC:H, the service deserializes the payload and executes attacker-controlled code in the elevated context of the IPAM service process, granting the attacker SYSTEM-level privileges on the host. No public exploit code has been identified, so reliable exploitation currently requires independent research into the specific deserialization pathway.