Windows Credential Providers CVE-2026-69729

Requires a low-privileged authenticated account (PR:L per CVSS vector) with network access to the target (AV:N). The 'authorized attacker' wording in the description confirms prior authentication is mandatory - unauthenticated exploitation is not supported by the available data. Attack complexity is low (AC:L) and no user interaction is required (UI:N), meaning exploitation does not depend on a victim action once the attacker has credentials. Exploitation is limited to unpatched builds of Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025; no non-default configuration requirement is described. Key limiting factor: the attacker must already possess or have compromised valid credentials for the target environment.

The CVSS 8.8 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H represents a high-severity, network-reachable vulnerability requiring only low-privilege credentials and no user interaction, with full confidentiality, integrity, and availability impact. The PR:L requirement - confirmed by the 'authorized attacker' phrasing in the description - meaningfully reduces real-world risk compared to unauthenticated (PR:N) bugs, since an attacker must first possess or steal valid credentials. However, AC:L and UI:N together mean that once credentials are obtained, exploitation is straightforward and automatable. No EPSS score or KEV listing is provided, so exploitation probability and active exploitation status cannot be independently verified from the available data. No public POC has been identified. The broad scope of affected platforms (Windows Server 2025 and three Windows 11 feature releases) and the central role of Credential Providers in authentication infrastructure make this a high-priority patch, particularly for externally accessible servers handling network authentication (e.g., RDP-exposed Windows Server 2025 hosts).

An attacker with a low-privilege domain or local account sends a specially crafted authentication request over the network to a targeted Windows Server 2025 host running an unpatched Credential Providers build. The malformed input triggers a heap buffer overflow, corrupting adjacent heap structures and redirecting execution to attacker-controlled code, resulting in full system compromise. No public exploit code has been identified at time of analysis.