EUVD-2026-73041
GHSA-fpcq-8j37-5rfc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged network user
-
DeliverySend crafted Group Policy data
-
ExploitTrigger untrusted pointer dereference
-
ExecutionCorrupt privileged memory
-
ImpactElevate to SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to hold valid low-privilege credentials on a machine reachable over the network (PR:L, AV:N) and the ability to reach the Windows Group Policy component; no user interaction is needed (UI:N). Affected are unpatched builds of Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), and Windows Server 2012 through 2025 (including Server Core), per the EUVD build ranges. The principal limiting factor is the authentication prerequisite - this is an elevation-of-privilege bug, not a pre-auth remote entry point - and exploitation is gated on running a build below the patched revision for each product line. |
| Impact | This is a genuinely serious but not top-tier-urgent issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-privilege, network-reachable elevation-of-privilege with total confidentiality/integrity/availability impact, and CISA's SSVC 'Technical Impact: total' corroborates the full-compromise outcome. However, the exploitation signals are all soft: SSVC Exploitation is 'none' (no observed exploitation), Automatable is 'no', there is no CISA KEV listing, and no public exploit code is identified. EPSS is only 0.70% (51st percentile), which is middling - consistent with a patched Microsoft EoP that is plausible-to-exploit but not currently trending. The signals are internally consistent rather than conflicting: high technical impact but no evidence of active exploitation, meaning this should be prioritized as part of the normal Microsoft patch cycle rather than treated as an emergency zero-day. One data caveat worth verifying: the CWE is listed as CWE-125 (out-of-bounds read) while the description says 'untrusted pointer dereference' (closer to CWE-822/CWE-476), a slight taxonomy mismatch that does not change the practical impact. |
| Exploit ScenarioDerived | A low-privileged authenticated user on the network sends crafted data to the Windows Group Policy component, triggering an untrusted pointer dereference that corrupts memory in a privileged context and lets the attacker elevate to SYSTEM. No user interaction is required and it works remotely against affected Windows client and server builds. No public proof-of-concept exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 22, 2026
Elevation of privilege in Windows Group Policy allows an attacker who already holds valid low-privilege credentials on a network-reachable machine to run code at high integrity/SYSTEM level by inducing an untrusted pointer dereference in the policy-processing component. Unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 (including Server Core installations) builds are affected, with builds below the fixed revision for each product line remaining exposed. Exploitation is unconfirmed: no public exploit code and no KEV listing exist, SSVC records Exploitation: none and Automatable: no, and EPSS is only 0.70% (51st percentile) - this is a genuinely serious but not top-tier-urgent issue, with the low-privilege authentication prerequisite (PR:L, AV:N) as the principal limiting factor.
Earlier versions of this analysis (1)
Privilege escalation via untrusted pointer dereference in the Windows Group Policy component affects every active Microsoft Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. An attacker holding a low-privileged domain account can exploit the flaw over the network when Group Policy processing is triggered, achieving high confidentiality, integrity, and availability impact equivalent to full system compromise. Microsoft has released patches across all affected branches; no CISA KEV listing or public proof-of-concept code has been identified at time of analysis.
RemediationAI
Vendor-released patches are available per Microsoft's MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69717); apply the current cumulative update for each product line so the build meets or exceeds the fixed revision - Windows 10 1607/Server 2016: 10.0.14393.9512; Windows 10 1809/Server 2019: 10.0.17763.9245; Windows 10 21H2: 10.0.19044.7725; Windows 10 22H2: 10.0.19045.7725; Windows 11 23H2: 10.0.22631.7582; Windows 11 24H2: 10.0.26100.9445; Windows 11 25H2: 10.0.26200.9445; Windows 11 26H1: 10.0.28000.2954; Server 2012: 6.2.9200.26349; Server 2012 R2: 6.3.9600.23397; Server 2022: 10.0.20348.5622; and Server 2025/Server Core: 10.0.26100.33438 - noting that Windows 10 21H2, 22H2 and Windows 11 23H2 are out of mainstream servicing on some editions and may require ESU or an in-place upgrade rather than a routine patch. Because exploitation requires valid low-privilege credentials over the network (PR:L, AV:N), the most effective compensating controls until patching completes are restricting east-west reachability to Group Policy delivery paths - block or segment SMB (TCP 445) and RPC endpoint mapper/dynamic RPC ranges between workstations and untrusted subnets, and enforce Windows Firewall rules so only domain controllers can serve policy to clients; the trade-off is that misapplied rules break policy refresh, drive mapping and login scripts, so stage them and validate with gpresult. Additionally, reduce the pool of credentials an attacker could use by removing unnecessary local admin and service accounts, tier-admin workstations so low-privilege users cannot reach management hosts, and monitor for anomalous gpsvc behavior or unexpected process creation from the Group Policy Client; WDAC/AppLocker can constrain post-exploitation payloads but will not prevent the underlying memory-safety fault and can cause application compatibility issues if applied too broadly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 19 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Group Policy is the central configuration-management framework in Windows: the Group Policy Client service (gpsvc) and related policy-processing code parse policy data sourced from domain controllers (SYSVOL/GPT templates), local policy stores, and network-delivered policy requests, then apply registry and security settings under high-integrity context. The flaw is a memory-safety defect in that parsing path - an untrusted pointer dereference that the attacker can influence through crafted policy data, causing the privileged service to follow a pointer it should have validated, with the assessed consequence being code execution in the service's security context (CVSS 3.1 vectors AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, total technical impact per SSVC). Note the mapping inconsistency in the incoming data: NVD associates this with CWE-125 (out-of-bounds read) while the description characterizes it as an untrusted pointer dereference, which is closer to the CWE-822/CWE-476 family; either way the root-cause class is inadequate validation of a memory reference derived from attacker-influenced input, and the practical effect is a local privilege boundary being crossed from a remote network position.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable EoP requiring existing low-privilege access (PR:L, AV:N, UI:N); successful dereference yields SYSTEM-level total impact, so C/I/A all High and AC:L per vendor.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Untrusted pointer dereference in Windows Group Policy allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
A privilege-escalation flaw in Windows Group Policy allows an attacker holding only low-privilege credentials on a network-reachable machine to execute code at SYSTEM level, affecting Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2012 through 2025, including Server Core installations. Because the flaw spans nearly every Windows build still in enterprise service, a single compromised user account could be leveraged to seize full control of domain-joined hosts, making this an estate-wide configuration and patching problem rather than an isolated system issue. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) activity, so leadership should treat this as a planned, high-severity remediation cycle while still updating the full Windows fleet on an accelerated schedule.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB