CVE-2026-69451

Windows Management Instrumentation Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 45th percentile. A vendor fix is available.

CVSS 3.17.1High EPSS percentile45th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-08Updated 2026-09-25Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your Windows OS build number and current patch level on each affected device.
Compare the build number to the fixed versions listed for your specific Windows release (from MSRC for CVE-2026-69451).
Install the Windows update(s) that move your system to at least the fixed version for your OS (per the MSRC update guide for CVE-2026-69451).
After updating, re-check the build number/patch level to confirm it reached the fixed version for your branch.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Windows Management Instrumentation allows an authorized attacker to elevate privileges over a network.

In plain language

Written by AI from the record

CVE-2026-69451 is a Windows “privilege upgrade” bug in Windows Management Instrumentation (WMI) that can let an attacker gain higher control; you should act if your devices run affected Windows versions and haven’t installed the specific fixed updates.

CVE-2026-69451 is a Windows Management Instrumentation (WMI) use-after-free (CWE-416) that can allow an authorized attacker to elevate privileges on affected Windows systems via network-accessible WMI-related paths.

If you're affected

Full takeover of the affected machine
Compromise of business file access
Ability to run malicious actions as admin

What is it

Windows Management Instrumentation (WMI) is like a remote “control panel” inside Windows that tools use to inspect and manage the system. This bug is a coding flaw that can let an attacker with the right kind of access jump from limited access to higher privileges. In plain terms: it can turn a person who shouldn’t be able to fully control the computer into someone who can.

Who is affected

This matters to you if you run Windows 10, Windows 11, or Windows Server 2012/2012 R2/2016/2019/2022/2025 in your business environment. Because the issue is reachable over the network (and requires the attacker to have an “authorized” level of capability), your risk is highest on machines that are reachable from other networks and where management interfaces can be accessed by untrusted parties. Treat it as a priority to fix wherever the vulnerable WMI behavior could be triggered from the network path to the device.

How urgent is it

This is an elevation-of-privilege bug affecting core Windows management functionality, and the reported traffic-light verdict is RED. Even though there’s no public exploit code on record and it’s not listed in CISA KEV, you should still treat this as urgent because an attacker who can reach the relevant WMI path could use it to gain higher control of the system.

What to do — in detail

Confirm exposure on each device
- For each machine running one of the affected operating systems, identify the exact OS build (the “10.0.xxxx…” / “6.2.xxxx…” / “6.3.xxxx…” style build shown by Windows). Also note the current patch level.
Determine whether you are below the fixed version
- Use these fixed targets from the MSRC update guide for CVE-2026-69451:
  - Windows 10
    - fixed in 10.0.14393.9512
    - fixed in 10.0.17763.9245
    - fixed in 10.0.19044.7725
    - fixed in 10.0.19045.7725
  - Windows 11
    - fixed in 10.0.22631.7582
    - fixed in 10.0.26100.9445
    - fixed in 10.0.26200.9445
    - fixed in 10.0.28000.2954
  - Windows Server 2012
    - fixed in 6.2.9200.26349
  - Windows Server 2012 R2
    - fixed in 6.3.9600.23397
  - Windows Server 2016
    - fixed in 10.0.14393.9512
  - Windows Server 2019
    - fixed in 10.0.17763.9245
Patch/upgrade
- Install the Windows updates that bring the machine to the fixed build for its branch.
- Use the MSRC update guide linked for CVE-2026-69451 (this is the authoritative source for the exact update packages): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69451
Validate
- After patching, re-check the OS build to confirm it is at (or above) the fixed version for that specific Windows release.
If you can’t patch immediately (temporary risk reduction)
- Limit network reachability to management-related services from untrusted networks (for example, avoid exposing administrative/WMI-related access broadly). This reduces the chance an attacker can even reach the vulnerable behavior.
What to monitor
- After rollout, watch for unusual authentication/remote management attempts and related alerts on the machines you updated (especially on systems that are commonly accessed remotely).

Technical context

CVE-2026-69451 (CWE-416) is a Windows Management Instrumentation (WMI) use-after-free vulnerability leading to elevation of privilege. The findings indicate no public exploit code on record and no CISA KEV entry, but press attention cites Qualys and the overall verdict is RED.

Attack characteristics from the provided scoring: network-based reachability (AV:N), low privileges required (PR:L), user interaction required (UI:R), and constrained complexity (AC:H). In exploitation terms, an attacker needs an “authorized” capability to trigger the privilege elevation rather than being fully anonymous.

EPSS is predicted at 0.7% (trend flat), but this is only a prediction and does not replace real-world exploitation signals.

Fix availability: the MSRC update guide provides build targets for Windows 10, Windows 11, Windows Server 2012/2012 R2/2016/2019; apply the corresponding update(s) to reach the fixed build for your exact OS branch.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS45th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 45th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 17 days, from the signal feeds we watch.

2026-09-25Patch availablerecord updated
2026-09-24Record updated
2026-09-10OpenVAS check added
2026-09-09Record updated
2026-09-08Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Scored 7.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable