CVE-2026-69364

Windows Print Spooler Components Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 35th percentile. A vendor fix is available.

CVSS 3.17.1High EPSS percentile35th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-08Updated 2026-09-24Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your exact Windows version and build (including Server editions) against the fixed versions listed below.
If you are on an affected build, schedule and install the Microsoft update that brings your system to at least the corresponding fixed build.
Re-check after updating that the OS build number matches one of the fixed versions for your specific Windows release.
Prioritize systems that are reachable from the network and any machines that run printing services (Print Spooler).

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network.

In plain language

Written by AI from the record

This is a Windows Print Spooler race-condition bug that can let an attacker with some access gain higher permissions; most small businesses should act by installing the Microsoft fixes for their Windows version.

CVE-2026-69364 is an elevation-of-privilege vulnerability in Windows Print Spooler components caused by a race condition (improper synchronization / concurrent execution) that can be triggered by an authorized attacker to gain higher privileges over a network; it is not listed in CISA KEV and no public exploit code is on record.

If you're affected

Admin-level takeover on Windows
Malware persistence via privileges
Service disruption via spooler abuse
Data theft from elevated access

What is it

Imagine the Print Spooler is a busy office mailbox that handles multiple requests at the same time. This bug is like a timing mistake where two workers can step on each other’s work, allowing someone who already has some access to “jump the line” and gain higher permissions.

Who is affected

This matters to you if you run Windows on endpoints or servers in these ranges (Windows 10, Windows 11, and Windows Server 2012/2012 R2/2016/2019/2022/2025) and the Print Spooler components are present. The risk is primarily if an attacker is already authorized and can reach/use the Print Spooler over the network (not just by being able to scan the internet).

How urgent is it

Treat this as RED priority because it targets privilege escalation in a core Windows service that can be abused for deeper compromise once an attacker has suitable access. Even though it is not on the CISA KEV list and there’s no public exploit code recorded, the attacker path involves “authorized” access and network reachability, so patching should not wait.

What to do — in detail

Confirm exposure

Identify which of the following you run: Windows 10, Windows 11, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, or Windows Server 2025.
Determine your exact OS version/build number (for example, by checking Windows “Version” and the “OS build” in system information).
Compare your build against the fixed builds below for your specific release.

Upgrade to fixed versions (pick the branch that matches your OS)

Windows 10 fixed in:
- 10.0.14393.9512
- 10.0.17763.9245
- 10.0.19044.7725
- 10.0.19045.7725
Windows 11 fixed in:
- 10.0.22631.7582
- 10.0.26100.9445
- 10.0.26200.9445
- 10.0.28000.2954
Windows Server 2012 fixed in:
- 6.2.9200.26349
Windows Server 2012 R2 fixed in:
- 6.3.9600.23397
Windows Server 2016 fixed in:
- 10.0.14393.9512
Windows Server 2019 fixed in:
- 10.0.17763.9245

Deployment notes / breaking-change considerations

This is an OS security update; test in a small batch (or with a maintenance window) if you have tightly managed print environments.
If you have applications heavily dependent on printing, schedule an update window to avoid service interruptions.

If patching is delayed (temporary risk reduction)

Reduce who can reach printing/spooler-related endpoints: limit network access to only the systems/users that truly need printing.
Avoid exposing print-related services to untrusted networks; restrict access using network controls.
Treat any abnormal Print Spooler activity as suspicious during the delay period (particularly unusual printing/spooler requests).

Monitoring after updating

Verify Print Spooler and printing-related operations remain stable.
Continue monitoring for unexpected authentication attempts and spooler-related errors/events that could indicate probing activity.

KEV timing

This CVE is not listed in CISA KEV, so there is no CISA due date provided by KEV in the findings.

Technical context

Severity and impact

CVE-2026-69364 is an elevation-of-privilege issue in Windows Print Spooler components with potential for complete compromise of the affected user/session by enabling higher privileges.

Weakness and mechanism

The underlying problem is a race condition (CWE-362: concurrent execution using shared resource with improper synchronization; and CWE-416: use-after-free is not indicated in the findings, but the weakness identifiers are provided as CWE-362 and CWE-416). The functional description indicates concurrent execution with improper synchronization in Print Spooler components, allowing a (already authorized) attacker to elevate privileges over a network.

Exploitation status

Not listed in CISA KEV.
No public exploit code is on record.
A predicted-likelihood estimate exists (flat trend), but no KEV/news confirmation of in-the-wild exploitation is provided in the findings.

Attack vector (as described by findings)

Network-triggered abuse of the Print Spooler components that can be leveraged by an attacker with appropriate authorization to reach the vulnerable code paths. The practical exposure therefore depends on both network reachability and the attacker having a level of access that qualifies as “authorized” in the findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS35th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 35th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 16 days, from the signal feeds we watch.

2026-09-24Patch availablepatch available, record updated, record updated
2026-09-10OpenVAS check added
2026-09-09Record updatedrecord updated
2026-09-08Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Scored 7.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable