EUVD-2026-99125
GHSA-ff7h-q33x-hmx3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account
-
DeliveryInvoke affected kernel-mode driver interface
-
ExploitTrigger incorrect authorization check
-
ExecutionRead unauthorized kernel/memory data
-
ImpactDisclose sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold a low-privileged authenticated local account on the Windows host and the ability to run code that interacts with the affected kernel-mode driver (PR:L, AV:L). It cannot be triggered over the network and needs no user interaction (UI:N). Impact is limited to information disclosure (C:H, I:N/A:N) - no modification or denial of service - and the exact driver, interface, or configuration that exposes the incorrect authorization check is not specified in the terse MSRC description, so the precise triggering feature cannot be named from available data. The principal limiting factors are the local-only vector and the requirement for prior authenticated access. |
| Impact | This is a genuine but moderate-priority issue, not an urgent one. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a locally exploitable, low-complexity flaw requiring an already-authenticated low-privileged user, with high confidentiality impact but no integrity or availability impact (C:H/I:N/A:N) - consistent with a local information-disclosure primitive rather than remote code execution or privilege escalation. All exploitation signals point the same direction and reinforce low real-world urgency: CISA SSVC records Exploitation=none, Automatable=no, and Technical Impact=partial, there is no CISA KEV listing, and no public POC is identified. EPSS is not provided in the input, so probabilistic exploitation likelihood could not be weighed. There is no conflict between CVSS and the description - both agree on local access and information disclosure. The main caveat is the 'Authentication Bypass' tag, which contradicts the CWE-863 (Incorrect Authorization) classification and the information-disclosure description; this appears to be a mislabel and should not be read as an auth-bypass capability. Net assessment: a legitimate local info-leak worth patching in routine cycles, but not a drop-everything priority. |
| Exploit ScenarioDerived | A low-privileged authenticated user already running code on a Windows host abuses an incorrect authorization check in a kernel-mode driver to read memory or data they should not be able to access, disclosing sensitive information locally. Because the CVSS vector is AV:L/AC:L, exploitation is straightforward for any local account but cannot be launched remotely and requires no victim interaction. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Information disclosure in Microsoft Windows kernel-mode drivers allows an attacker who already holds a low-privileged local account to read data they are not authorized to access, stemming from an incorrect authorization check (CWE-863) rather than a memory-safety bug. Only local access is required (AV:L, PR:L) with no user interaction (UI:N), and the impact is confined to confidentiality (C:H) with no integrity or availability effect, giving a moderate CVSS 3.1 base score of 5.5. Microsoft has released fixes through the MSRC update guide covering Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 (including Server Core); there is no public exploit identified at time of analysis, no CISA KEV listing, and CISA's SSVC assessment records exploitation as none and automatable as no.
RemediationAI
Apply the Microsoft security update for CVE-2026-69971 through the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69971) or the normal Windows Update / WSUS / Windows Server Update Services channel; the patched builds identified in the version data are 10.0.28000.3231 for Windows 11 26H1, 10.0.26300.9711 for Windows 11 26H2, 10.0.26100.9711 for Windows 11 24H2, 10.0.26200.9711 for Windows 11 25H2, and 10.0.26100.33650 for both Windows Server 2025 and its Server Core installation - installations at or above those builds are not affected. Vendor-released patch: see the MSRC advisory for the exact cumulative update packages and supersedence chain. Because exploitation requires an attacker to already hold a low-privileged authenticated local account and execute code locally, the most effective compensating controls until patching is complete are to reduce the number of local interactive and logon-capable accounts on affected hosts (trading off normal administrative and remote-work workflows), to keep local user rights assignments tightly scoped and remove unnecessary local administrator membership, and to monitor for unusual local processes or tooling that probes kernel drivers for information disclosure. Where operationally feasible, deploying a Microsoft-recommended vulnerable driver blocklist or a WDAC/AppLocker policy that restricts which kernel drivers may load can reduce exposure, at the cost of potentially blocking legitimate third-party drivers and requiring careful test-and-rollout. There is no KEV-listed exploitation or public exploit code at time of analysis, so emergency out-of-band deployment is not warranted; treat this as a routine monthly patch-cycle item.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an incorrect authorization weakness (CWE-863) inside Windows kernel-mode drivers, meaning the driver performs an access/permission decision against a caller and gets it wrong - for example resolving or validating a caller's token, privilege, or handle rights incorrectly - and then returns information the caller should not be entitled to. Unlike classic kernel memory-corruption bugs, this is a logic-class access-control defect, which is why the CVSS impact is limited to confidentiality with no integrity or availability component. Because the vulnerable code runs in kernel mode, successful abuse can expose kernel- or driver-managed data that normally sits above the attacker's privilege level, potentially leaking pointer values or other information useful for weakening KASLR and hardening the reliability of follow-on kernel exploits. The MSRC description does not name the specific driver, IOCTL, or Windows subsystem involved, so the exact triggering interface cannot be determined from the available data; the CPE/version data ties the issue to the current Windows servicing branches - Windows 11 24H2, 25H2, 26H1, 26H2, and Windows Server 2025 (including Server Core) - which all share the same kernel servicing baseline. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the prerequisite of an existing low-privileged authenticated local session; the vulnerability cannot be reached over the network and requires no victim interaction.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local kernel-driver access by an authenticated low-privileged user (AV:L/PR:L), low complexity, yielding information disclosure only, so C:H with I:N/A:N and no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB