Windows Secure Kernel CVE-2026-69846

Exploitation requires a locally authenticated account with administrator-level (high) privileges on the target Windows system - the CVSS PR:H metric confirms this prerequisite. The attacker must have code execution in VTL0 kernel or administrator context to interact with the Secure Kernel interface. The vulnerability is exploitable only on systems where Virtualization-Based Security is active, which is the default for eligible hardware on Windows 11 and optional on Windows 10/Server. Systems with VBS explicitly disabled are not vulnerable to the VTL1 escalation but lose the security protections VBS provides. No network access is required; the attack is strictly local. User interaction is not needed after the attacker gains the required privilege level.

The CVSS 8.2 score accurately captures a meaningful but contextually bounded risk: AV:L restricts exploitation to actors with existing local access, and PR:H confirms that a fully privileged (administrator-level) account is required before the overflow can be triggered - meaning this is not an entry-point vulnerability but a post-compromise escalation path. The scope change (S:C) is the most consequential element: successfully defeating the secure kernel breaks Credential Guard isolation, potentially exposing hashed or plaintext credentials and undermining HVCI integrity guarantees, which cascades into persistent, difficult-to-detect compromise. EPSS data is absent from the provided intelligence, and no KEV listing or POC is present, so exploitation probability cannot be quantified beyond the CVSS signal. The practical threat model is a sophisticated attacker who has already obtained admin rights and seeks to defeat VBS-based defenses - a post-breach lateral movement or persistence scenario. Even a mid-sized municipal IT team in rybnik that has deployed Credential Guard as a ransomware defense should treat this as urgent, since a successful exploit would silently negate that control. The combination of broad OS surface, no workaround short of patching, and the high downstream impact of VBS bypass pushes real-world priority above the raw score alone might suggest.

An attacker who has compromised a Windows endpoint and escalated to local administrator submits a crafted system call targeting the Secure Kernel interface, supplying parameters engineered to trigger the integer overflow and corrupt VTL1 memory. Successful exploitation grants the attacker code execution within the secure kernel, allowing extraction of Credential Guard-protected NTLM hashes or LSA secrets and permanent disablement of HVCI integrity checks. No public proof-of-concept exists at time of analysis, so exploitation requires significant Windows internals expertise.