What is the CVSS score of CVE-2026-69859?

CVE-2026-69859 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Windows 10 1607 CVE-2026-69859

Q: Which versions of Windows 10 1607 are affected by CVE-2026-69859?

A privilege escalation vulnerability in the Windows USB Audio Class kernel driver (usbaudio.sys) enables low-privilege local users to achieve complete system control.. A patch is available.

Q: How to fix or mitigate CVE-2026-69859?

Within 24 hours, inventory all Windows systems running versions 10 (1607 and later), Windows 11 (through 26H2), or Windows Server (2012 through 2025) to establish patch scope. Patch available per vendor advisory; deploy through Windows Update or WSUS within 7 days, prioritizing production servers and security-sensitive systems. Within 30 days, complete patch verification across all affected systems, confirm usbaudio.sys is updated to the patched version, and review local user account privileges to restrict exploitation potential.

EUVD-2026-73038 HIGH

Integer Underflow (CWE-191)

2026-09-08 secure@microsoft.com

GHSA-6p44-9w5c-xfm4

Information Disclosure Integer Overflow Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.0

CVSS 3.1 · Vendor: microsoft

View

Vulnerability Assessment

Weakness

CWE

CWE-191

ASVS 5.0

V15 - Secure Coding and Architecture Integer underflow checks

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 09, 2026

Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is possible through a time-of-check time-of-use (TOCTOU) race condition. An authenticated local attacker with low privileges can win the race window to escalate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, but the breadth of affected Windows versions — spanning Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025 — gives this vulnerability a large attack surface.

Affected VersionsENISA

Windows Server 2012 (Server Core installation) 6.2.9200.0 <6.2.9200.26349

Windows 11 Version 24H2 10.0.26100.0 <10.0.26100.9445

Windows 10 Version 22H2 10.0.19045.0 <10.0.19045.7725

Windows 11 Version 25H2 10.0.26200.0 <10.0.26200.9445

Windows Server 2012 R2 6.3.9600.0 <6.3.9600.23397

Windows Server 2016 10.0.14393.0 <10.0.14393.9512

Windows 10 Version 1809 10.0.17763.0 <10.0.17763.9245

Windows Server 2012 6.2.9200.0 <6.2.9200.26349

Windows Server 2025 (Server Core installation) 10.0.26100.0 <10.0.26100.33438

Windows Server 2025 10.0.26100.0 <10.0.26100.33438

Windows 10 Version 1607 10.0.14393.0 <10.0.14393.9512

Windows Server 2012 R2 (Server Core installation) 6.3.9600.0 <6.3.9600.23397

Windows Server 2019 (Server Core installation) 10.0.17763.0 <10.0.17763.9245

Windows Server 2019 10.0.17763.0 <10.0.17763.9245

Windows 11 version 26H1 10.0.28000.0 <10.0.28000.2954

Windows Server 2022 10.0.20348.0 <10.0.20348.5622

Windows 11 Version 23H2 10.0.22631.0 <10.0.22631.7582

Windows 10 Version 21H2 10.0.19044.0 <10.0.19044.7725

Windows Server 2016 (Server Core installation) 10.0.14393.0 <10.0.14393.9512

Affected Packages

euvd windows_10_version_1607 fix: 10.0.14393.9512

euvd windows_10_version_1809 fix: 10.0.17763.9245

euvd windows_10_version_21h2 fix: 10.0.19044.7725

euvd windows_10_version_22h2 fix: 10.0.19045.7725

euvd windows_11_version_23h2 fix: 10.0.22631.7582

euvd windows_11_version_24h2 fix: 10.0.26100.9445

euvd windows_11_version_25h2 fix: 10.0.26200.9445

euvd windows_11_version_26h1 fix: 10.0.28000.2954

euvd windows_server_2012 fix: 6.2.9200.26349

euvd windows_server_2012_r2 fix: 6.3.9600.23397

euvd windows_server_2012_r2_server_core_installation fix: 6.3.9600.23397

euvd windows_server_2012_server_core_installation fix: 6.2.9200.26349

euvd windows_server_2016 fix: 10.0.14393.9512

euvd windows_server_2016_server_core_installation fix: 10.0.14393.9512

euvd windows_server_2019 fix: 10.0.17763.9245

euvd windows_server_2019_server_core_installation fix: 10.0.17763.9245

euvd windows_server_2022 fix: 10.0.20348.5622

euvd windows_server_2025 fix: 10.0.26100.33438

euvd windows_server_2025_server_core_installation fix: 10.0.26100.33438

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 19 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Windows 10 1607 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Sep 08, 2026 - 18:35 EUVD

CVE Published

Sep 08, 2026 - 18:19 nvd

HIGH 7.0

DescriptionCVE.org

Time-of-check time-of-use (toctou) race condition in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

Executive ViewAI

Why It Matters

A privilege escalation vulnerability in the Windows USB Audio Class kernel driver (usbaudio.sys) enables low-privilege local users to achieve complete system control. The vulnerability spans Windows 10, Windows 11, and Windows Server versions from 2012 through 2025, creating substantial risk for organizations where non-administrator users retain local system access.

Recommended Action

Within 24 hours, inventory all Windows systems running versions 10 (1607 and later), Windows 11 (through 26H2), or Windows Server (2012 through 2025) to establish patch scope. Patch available per vendor advisory; deploy through Windows Update or WSUS within 7 days, prioritizing production servers and security-sensitive systems. Within 30 days, complete patch verification across all affected systems, confirm usbaudio.sys is updated to the patched version, and review local user account privileges to restrict exploitation potential.

Business Impact: High

Compensating Controls

Apply vendor patch. Pending patch deployment, restrict local user privileges, disable USB audio functionality on systems where not required, and enforce driver signature enforcement through Secure Boot and Code Integrity policies.

Threat Intelligence Overview

EPSS Score

0.2%

Top 91% exploitable

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Defer

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +35

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.