CVE-2026-69821

HighCVSS 7.8/10Last modified Sep 24, 2026

Description

Improper encoding or escaping of output in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-116

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1607	>= 10.0.14393.0, < 10.0.14393.9512
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.9245
Microsoft	Windows Server 2012	>= 6.2.9200.0, < 6.2.9200.26349
Microsoft	Windows Server 2012 (Server Core installation)	>= 6.2.9200.0, < 6.2.9200.26349
Microsoft	Windows Server 2012 R2	>= 6.3.9600.0, < 6.3.9600.23398
Microsoft	Windows Server 2012 R2 (Server Core installation)	>= 6.3.9600.0, < 6.3.9600.23398
Microsoft	Windows Server 2016	>= 10.0.14393.0, < 10.0.14393.9512
Microsoft	Windows Server 2016 (Server Core installation)	>= 10.0.14393.0, < 10.0.14393.9512
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.9245
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.9245
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.5622
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.33438
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.33438

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69821Patch, Vendor Advisory

Timeline

Published: Sep 8, 2026
Last modified: Sep 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-698227.8Numeric truncation error in Windows Kerberos allows an authorized attacker to elevate privileges locally.CVE-2026-698249.8Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an unauthorized attacker to execute code over a network.CVE-2026-698268.0Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges over a network.CVE-2026-698278.1Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to CVE-2026-698299.8Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.CVE-2026-69834.7A vulnerability was identified in pagekit up to 1.0.18. Affected by this issue is some unknown functionality of the file /index.php/admin/sy CVE-2026-698308.1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized at CVE-2026-698324.7Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose infor CVE-2026-698347.0Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally.CVE-2026-6983610.0Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.CVE-2026-698387.0Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-698396.5Uncaught exception in Windows iSCSI Target Service allows an authorized attacker to deny service over a network.