What is the CVSS score of CVE-2026-69819?

CVE-2026-69819 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

How to fix or mitigate CVE-2026-69819?

Within 24 hours, inventory all Windows systems by operating system version and create a prioritized patch deployment plan focused on production servers (Server 2019, 2022, 2025) and critical infrastructure; begin immediate patch deployment to these server versions. Within 7 days, complete patching of all Windows Server 2012 through Server 2025 instances in all environments. Within 30 days, deploy the Microsoft security patch to all Windows client systems (Windows 7 through Windows 11 including 25H2/26H1) across the organization. For systems that cannot be patched within 24 hours, implement network access controls to restrict RPC traffic (TCP/UDP 135, 139, 445, and ephemeral ports 49152-65535) until patched.

Windows RPC Runtime CVE-2026-69819

Q: Which versions of Windows RPC Runtime are affected by CVE-2026-69819?

A critical remote code execution vulnerability in Windows RPC Runtime affects all supported Windows versions from Server 2012 through 2025 and Windows 7-11, allowing unauthenticated network attackers…. A patch is available.

EUVD-2026-73053 CRITICAL

Out-of-bounds Write (CWE-787)

2026-09-08 secure@microsoft.com

GHSA-9jx2-pm5q-rx3m

Buffer Overflow Memory Corruption Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

9.8

CVSS 3.1 · Vendor: microsoft

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach exposed RPC endpoint over network
Delivery

Send crafted RPC request
Exploit

Trigger out-of-bounds write in RPC Runtime
Execution

Corrupt memory and hijack execution
Persist

Execute arbitrary code in service context
Impact

Lateral movement / full compromise

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions per CVSS - remote unauthenticated exploitation over the network against the RPC Runtime with no user interaction (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is network reachability of a vulnerable RPC endpoint: the attacker must be able to reach an exposed MSRPC interface (e.g., via TCP 135 and dynamic RPC ports, or named pipes over SMB), so hosts whose RPC surface is firewalled off from untrusted networks are not directly reachable from outside those segments. All listed Windows versions below their fixed build are vulnerable regardless of configuration.
Impact	This is a genuine high-priority issue. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) describes unauthenticated, low-complexity, network-triggerable RCE with full confidentiality/integrity/availability impact - the profile of a potentially wormable vulnerability given RPC's ubiquity. Microsoft confirms a patch is available. There is currently no KEV listing and no public exploit identified, and no EPSS score was provided, so exploitation appears not-yet-observed rather than confirmed-in-the-wild; however, memory-corruption RCE in the RPC Runtime historically attracts exploit development quickly. No signals conflict: the network vector matches a network-reachable RPC component. The main unknown is whether the vulnerable RPC interface is reachable in default firewall configurations or requires an exposed endpoint - Microsoft's advisory should be consulted to confirm the affected interface and default exposure.
Exploit ScenarioDerived	An attacker with network reachability to a vulnerable Windows host sends a specially crafted RPC request to an exposed RPC endpoint, triggering the out-of-bounds write in the RPC Runtime and corrupting memory to gain arbitrary code execution in the context of the RPC service. Requiring no credentials or user interaction, this could be scripted for automated mass exploitation or lateral movement across an internal network. No public exploit code is identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 09, 2026

Remote code execution in the Microsoft Windows RPC Runtime (rpcrt4) allows an unauthorized network attacker to trigger an out-of-bounds write and execute arbitrary code, per CVSS with no authentication or user interaction. All supported Windows client and server releases from Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. No public exploit identified at time of analysis, but the network-facing, unauthenticated RPC attack surface gives this significant wormable potential.

RemediationAI

Apply the Microsoft security update for CVE-2026-69819 for your specific Windows build; Patch available per vendor advisory, with fixed builds enumerated per release (e.g., Server 2019 10.0.17763.9245, Server 2022 10.0.20348.5622, Windows 10 22H2 10.0.19045.7725, Windows 11 24H2 10.0.26100.9445, Server 2025 10.0.26100.33438) - see https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69819. Prioritize internet-exposed and domain-controller/server systems. Until patching completes, restrict RPC exposure at the network boundary by blocking the RPC endpoint mapper (TCP 135) and dynamic high-port RPC ranges from untrusted networks and limiting SMB/named-pipe RPC to trusted management segments; note the trade-off that RPC is used by AD replication, remote management (WMI, MMC, service control) and other core operations, so overly broad blocking can break domain and administrative functionality, and internal lateral movement remains possible even with perimeter blocks.

Affected VersionsENISA

Windows Server 2019 10.0.17763.0 <10.0.17763.9245

Windows Server 2012 R2 (Server Core installation) 6.3.9600.0 <6.3.9600.23397

Windows Server 2016 10.0.14393.0 <10.0.14393.9512

Windows 11 Version 24H2 10.0.26100.0 <10.0.26100.9445

Windows Server 2012 6.2.9200.0 <6.2.9200.26349

Windows Server 2022 10.0.20348.0 <10.0.20348.5622

Windows 10 Version 1607 10.0.14393.0 <10.0.14393.9512

Windows 11 Version 23H2 10.0.22631.0 <10.0.22631.7582

Windows Server 2016 (Server Core installation) 10.0.14393.0 <10.0.14393.9512

Windows 10 Version 22H2 10.0.19045.0 <10.0.19045.7725

Windows Server 2025 (Server Core installation) 10.0.26100.0 <10.0.26100.33438

Windows 11 Version 25H2 10.0.26200.0 <10.0.26200.9445

Windows 10 Version 1809 10.0.17763.0 <10.0.17763.9245

Windows Server 2012 R2 6.3.9600.0 <6.3.9600.23397

Windows 11 version 26H1 10.0.28000.0 <10.0.28000.2954

Windows Server 2025 10.0.26100.0 <10.0.26100.33438

Windows Server 2012 (Server Core installation) 6.2.9200.0 <6.2.9200.26349

Windows Server 2019 (Server Core installation) 10.0.17763.0 <10.0.17763.9245

Windows 10 Version 21H2 10.0.19044.0 <10.0.19044.7725

Affected Packages

euvd windows_10_version_1607 fix: 10.0.14393.9512

euvd windows_10_version_1809 fix: 10.0.17763.9245

euvd windows_10_version_21h2 fix: 10.0.19044.7725

euvd windows_10_version_22h2 fix: 10.0.19045.7725

euvd windows_11_version_23h2 fix: 10.0.22631.7582

euvd windows_11_version_24h2 fix: 10.0.26100.9445

euvd windows_11_version_25h2 fix: 10.0.26200.9445

euvd windows_11_version_26h1 fix: 10.0.28000.2954

euvd windows_server_2012 fix: 6.2.9200.26349

euvd windows_server_2012_r2 fix: 6.3.9600.23397

euvd windows_server_2012_r2_server_core_installation fix: 6.3.9600.23397

euvd windows_server_2012_server_core_installation fix: 6.2.9200.26349

euvd windows_server_2016 fix: 10.0.14393.9512

euvd windows_server_2016_server_core_installation fix: 10.0.14393.9512

euvd windows_server_2019 fix: 10.0.17763.9245

euvd windows_server_2019_server_core_installation fix: 10.0.17763.9245

euvd windows_server_2022 fix: 10.0.20348.5622

euvd windows_server_2025 fix: 10.0.26100.33438

euvd windows_server_2025_server_core_installation fix: 10.0.26100.33438

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 19 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The Remote Procedure Call (RPC) Runtime library (rpcrt4.dll) is a core Windows component that marshals and dispatches RPC calls used by countless local and network services (SMB-adjacent services, DCOM, MSRPC endpoints over TCP/UDP and named pipes). The root cause is CWE-787 (out-of-bounds write): malformed RPC data drives the runtime to write past the bounds of an allocated buffer, corrupting adjacent memory. Because the RPC Runtime underpins so many endpoints, a flaw here is exploitable through any exposed RPC interface rather than a single application. The CPE/version data spans the full Windows family (e.g., Server 2019 <10.0.17763.9245, Server 2022 <10.0.20348.5622, Windows 10 22H2 <10.0.19045.7725, Windows 11 24H2 <10.0.26100.9445), consistent with a shared OS component.

Know when Windows 10 1607 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Network-reachable RPC Runtime with unauthenticated, no-interaction OOB-write RCE yields full C/I/A impact; scope unchanged as code runs within the service context.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Sep 08, 2026 - 18:35 EUVD

CVE Published

Sep 08, 2026 - 18:19 nvd

CRITICAL 9.8

DescriptionCVE.org

Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network.

Executive ViewAI

Why It Matters

A critical remote code execution vulnerability in Windows RPC Runtime affects all supported Windows versions from Server 2012 through 2025 and Windows 7-11, allowing unauthenticated network attackers to execute arbitrary code with no user interaction required. The broad attack surface and wormable potential create immediate risk of widespread infrastructure compromise across servers and workstations. Organizations must prioritize rapid deployment of the Microsoft security patch to prevent potential enterprise-wide compromise.

Business Impact: Severe

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.9%

Top 42% exploitable

Prevalence

Ubiquitous

Core RPC component present in every supported Windows client and server

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

5 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.9%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.