Windows Wired AutoConfig CVE-2026-69798

Exploitation requires local, authenticated access to the Windows host with at least low-privilege user rights (PR:L), and no user interaction is needed (UI:N). The attacker must be able to interact with the Windows Wired AutoConfig service (dot3svc), which handles IEEE 802.1X authentication for wired Ethernet adapters; a practical limiting factor is that dot3svc commonly ships with Manual (trigger-start) startup, so the service generally must be running or triggerable for the vulnerable code path to be reached. Limiting factors that reduce real-world risk: no network vector (the attacker must already be on the machine) and a valid local account is required - this cannot be exploited by an unauthenticated remote attacker.

CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, describing a local, low-privilege elevation-of-privilege flaw with high confidentiality, integrity and availability impact and no user interaction. This is a classic Windows local privilege escalation profile: it is NOT remotely exploitable, so initial access to the host is a hard prerequisite, which meaningfully reduces mass-exploitation risk. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical priority is elevated for multi-stage intrusions and post-compromise scenarios (malware, phishing follow-on, or an already-authenticated adversary seeking SYSTEM), but lower for perimeter-facing triage because the attacker must already be on the box. Memory-corruption (use-after-free) EoP bugs in core Windows services historically do attract reliable exploits over time, so the absence of a POC today should be treated as 'not yet observed,' not 'not exploitable.' Note the metadata tension flagged below: the vulnerability is a use-after-free that Microsoft describes as privilege elevation, yet it also carries a 'Denial Of Service' tag - the CIA-high EoP framing in the CVSS vector and description should be treated as authoritative over the DoS tag.

An attacker who has already obtained low-privileged authenticated access to a Windows host - for example via phishing, stolen credentials, or a prior foothold - runs a local program that interacts with the Wired AutoConfig (dot3svc) service to trigger the use-after-free condition. By grooming the freed object and controlling the dangling reference, the attacker corrupts memory in the service's context to execute arbitrary code and elevate from a standard user to SYSTEM. No public exploit code was identified in the provided data, so a working exploit would currently need to be developed.