What is the CVSS score of CVE-2026-69859?

CVE-2026-69859 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Microsoft are affected by CVE-2026-69859?

A privilege escalation vulnerability in the Windows USB Audio Class kernel driver (usbaudio.sys) enables low-privilege local users to achieve complete system control.. A patch is available.

How to fix or mitigate CVE-2026-69859?

Within 24 hours, inventory all Windows systems running versions 10 (1607 and later), Windows 11 (through 26H2), or Windows Server (2012 through 2025) to establish patch scope. Patch available per vendor advisory; deploy through Windows Update or WSUS within 7 days, prioritizing production servers and security-sensitive systems. Within 30 days, complete patch verification across all affected systems, confirm usbaudio.sys is updated to the patched version, and review local user account privileges to restrict exploitation potential.

Microsoft CVE-2026-69859

EUVD-2026-73038 HIGH

Integer Underflow (CWE-191)

2026-09-08 secure@microsoft.com

GHSA-6p44-9w5c-xfm4

Information Disclosure Integer Overflow Microsoft

7.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 09, 2026 - 01:07 vuln.today

Patch available

Sep 08, 2026 - 18:35 EUVD

CVE Published

Sep 08, 2026 - 18:19 nvd

HIGH 7.0

DescriptionCVE.org

Time-of-check time-of-use (toctou) race condition in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is possible through a time-of-check time-of-use (TOCTOU) race condition. An authenticated local attacker with low privileges can win the race window to escalate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the affected system. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, inventory all Windows systems running versions 10 (1607 and later), Windows 11 (through 26H2), or Windows Server (2012 through 2025) to establish patch scope. …

Threat intelligence, references, and detailed analysis are available after sign-in.