Windows Server NDES CVE-2026-69802

Exploitation requires that the target run the Active Directory Certificate Services (AD CS) Network Device Enrollment Service (NDES) role - an optional, non-default role used for SCEP-based certificate enrollment (commonly in MDM/network-device PKI scenarios) - and that its HTTP(S) enrollment endpoint be network-reachable by the attacker. No credentials (PR:N) and no user interaction (UI:N) are needed. The principal limiting factor is CVSS AC:H: successful exploitation depends on conditions the attacker cannot fully control (a weak-authentication edge case such as a timing/state window), which, combined with SSVC Automatable=no, means it cannot be reliably sprayed at scale. Servers without the NDES role installed are not affected regardless of patch level.

Signals conflict and should be weighed carefully. CVSS 8.1 (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated flaw with total CIA impact, which looks alarming - but the High attack complexity (AC:H) is doing real work here: successful exploitation depends on conditions outside the attacker's control (likely a weak-authentication edge case or race rather than a trivial bypass). CISA's SSVC framework reinforces a tempered view: Exploitation=none (no observed exploitation), Automatable=no (cannot be reliably mass-scanned/sprayed), yet Technical Impact=total (full compromise if it works). There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so this is best treated as a high-impact-but-currently-unexploited issue rather than an active emergency. It is Microsoft-reported (secure@microsoft.com) with a patch available, consistent with a coordinated Patch-Tuesday-style disclosure. Net: a serious patch-soon item for organizations running NDES - the total technical impact and unauthenticated network vector justify prioritization - but the AC:H and SSVC Automatable=no signals argue against treating it as a drop-everything, worm-able threat. Absence of EPSS/KEV/POC is a lack of signal, not evidence of safety.

An attacker who can reach the Network Device Enrollment Service (NDES) HTTP endpoint across the network exploits a weak-authentication weakness (CWE-1390) to bypass intended identity verification and execute code on the enrollment server, without any valid credentials or user interaction. Because CVSS specifies AC:H, the attacker must satisfy non-trivial conditions (e.g., a timing window or a specific authentication state) rather than firing a single reliable request. No public exploit code is identified at time of analysis, and SSVC rates the flaw as not automatable, so opportunistic mass exploitation is unlikely.