CVE-2026-69585

Windows Search is part of Windows that helps find files and content. This vulnerability is like a mistake in how Windows handles internal data types; if someone already has an account on your machine, that mistake could let them get much higher permissions than they should.

This matters if you use Microsoft Windows Search on any of these systems: Windows 10, Windows 11, or the listed Windows Server editions (2012/2012 R2/2016/2019/2022/2025). The risk is mainly for scenarios where an attacker already has an authorized foothold on the machine (for example, a user account on the system). Because this is a local elevation-of-privilege problem, it’s only a meaningful risk when the attacker can reach and interact with the local system under an account.

This is a RED issue because it’s an elevation-of-privilege vulnerability in a core Windows component: if someone already has local access, they can potentially gain much higher control. Even though there’s no public exploit code on record and it’s not listed in CISA KEV, you should still patch quickly to close the privilege-escalation path.

1. Confirm exposure on each device

   • On each affected machine, check the Windows version/build number.
   • Determine which branch you’re on (Windows 10 / Windows 11 / specific Windows Server year).
   • Compare your current build to the fixed versions below. If your build is older than the fixed value for your edition, it’s considered vulnerable per the provided patch information.

2. Apply the fix

   • Patch using your standard Windows update method (Windows Update, WSUS, or your managed patch pipeline).
   • Upgrade/patch to at least one of these fixed versions (choose the one that matches your OS branch):
     • Windows 10 → fixed in 10.0.14393.9512 / 10.0.17763.9245 / 10.0.19044.7725 / 10.0.19045.7725
     • Windows 11 → fixed in 10.0.22631.7582 / 10.0.26100.9445 / 10.0.26200.9445 / 10.0.28000.2954
     • Windows Server 2012 → fixed in 6.2.9200.26349
     • Windows Server 2012 R2 → fixed in 6.3.9600.23397
     • Windows Server 2016 → fixed in 10.0.14393.9512
     • Windows Server 2019 → fixed in 10.0.17763.9245

3. Reboot and verify

   • Reboot after installation.
   • Re-check the build number to ensure it matches (or exceeds) the fixed version stated for your edition.

4. Temporary containment if patching is delayed

   • Reduce the number of users who can log on locally and remove any unnecessary local admin privileges.
   • Review for unexpected local accounts or accounts added recently.
   • Keep endpoint incident detection/logging enabled so you can spot suspicious local activity sooner.

5. What to monitor after patching

   • Confirm there are no recurring update failures.
   • If you have security monitoring, watch for signs of local privilege escalation attempts (unusual processes running with elevated rights, unexpected service changes), and validate those alerts stop after patching.

Note: This issue is not listed in CISA KEV based on the provided findings, and no public exploit code is recorded; however, the impact of local privilege escalation is high, so patching is still the right action.

CVE-2026-69585 is a Microsoft Windows Search Component elevation of privilege vulnerability (CWE-704). The underlying mechanism is an incorrect type conversion/cast that can be abused by an authorized attacker to elevate privileges locally. Based on the provided findings, there is no public exploit code on record and it is not listed in CISA KEV. EPSS is reported as a prediction (not a guarantee) and is flat, but the overall operational risk remains high because local privilege escalation can enable full control if an attacker already has an account on the system. The affected scope includes Windows 10, Windows 11, and multiple Windows Server editions listed in the findings, with fixes available in the specific fixed build numbers provided.