Windows Kernel CVE-2026-69723

Exploitation requires a valid low-privileged account (PR:L per CVSS vector) - unauthenticated network exploitation is not possible. User interaction is also required (UI:R): a legitimate logged-in user on the target system must perform a specific action to trigger the disclosure; the exact nature of this interaction is not described in the available advisory text. The attack vector is network (AV:N), so the attacker does not need physical or local access to the target. Attack complexity is low (AC:L), meaning no race conditions or special timing are required beyond satisfying the auth and interaction prerequisites. The vulnerability is constrained to confidentiality only (I:N/A:N) and does not cross a scope boundary (S:U). Exploitation is limited by: possession of a valid user-level credential, the necessity of victim user interaction, and network-layer access controls governing which accounts can reach the kernel interface in question.

The CVSS 3.1 base score of 5.7 (Medium) is computed from AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N. The C:H impact is notable, but two structural mitigations suppress practical risk: PR:L (the attacker must hold a valid low-privileged account) and UI:R (a legitimate user must perform some interaction to trigger disclosure). These two requirements together make opportunistic mass exploitation unlikely. No EPSS data was provided in the input; KEV status is not confirmed; no public exploit is identified. The scope (S:U) being unchanged means lateral blast radius is limited to the single affected host. Real-world priority is moderate: the ubiquitous deployment footprint of Windows raises the aggregate risk across large enterprise environments, but the authentication + interaction gate substantially narrows the realistic attacker population compared to unauthenticated kernel flaws.

An attacker with a low-privileged account on the target network crafts a malicious resource or request and socially engineers an authenticated user on a target Windows host into interacting with it (e.g., opening a crafted file or accessing a prepared network share). This interaction triggers a kernel code path that exposes sensitive system information - potentially including kernel addresses, handle values, or configuration data - back to the attacker over the network. No public exploit code has been identified at time of analysis, making this scenario most plausible as a targeted attack rather than commodity exploitation.