Windows TCP/IP CVE-2026-69793

Exploitation requires only network access to a vulnerable Windows host with TCP/IP exposed - no authentication, no user interaction, and no special configuration beyond a default Windows installation. This applies to all listed versions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The limiting factor is the nature of the bypass: the attacker gains the ability to circumvent a network-level security feature (such as WFP filtering or IPsec enforcement), but must then leverage that bypass to achieve a concrete secondary impact; the direct outcome is integrity compromise of the security boundary, not arbitrary code execution in isolation. Systems that do not rely on Windows host-based TCP/IP security controls (and are fully protected by external network controls) face reduced downstream risk from the bypass itself.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, score 7.5) accurately reflects a remotely triggerable, zero-authentication integrity bypass. The high integrity impact (I:H) is notable: a security feature bypass in the TCP/IP layer can allow an attacker to inject or pass traffic that would otherwise be blocked by Windows Filtering Platform rules, IPsec enforcement, or similar mechanisms - enabling downstream attacks that rely on these controls being active. The absence of confidentiality and availability impact is consistent with a pure bypass primitive. No EPSS data is provided, no KEV listing is present, and no public exploit code has been identified, which collectively suggest no active exploitation at this time. However, the ubiquitous deployment footprint across client and server editions and the low complexity / no-authentication CVSS metrics make this a meaningful priority for internet-exposed Windows systems, particularly those relying on host-based TCP/IP security features as a defense layer.

An unauthenticated attacker on the internet sends a crafted TCP/IP packet with mutually inconsistent header fields to a vulnerable Windows host - for example, contradictory fragment offsets or mismatched length indicators - causing the Windows TCP/IP driver to mishandle the validation check and bypass an active security feature such as a Windows Filtering Platform rule. This bypass could then allow subsequent traffic or payloads that would normally be blocked to reach a protected service or endpoint, enabling further exploitation. No public exploit code has been identified at time of analysis.