CVE-2026-70580

HighCVSS 8.8/10Last modified Oct 16, 2026

Description

Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 16, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-705817.8Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-705826.4Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an CVE-2026-705837.8Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally.CVE-2026-705847.8Access of resource using incompatible type ('type confusion') in Windows Core Messaging allows an authorized attacker to elevate privileges CVE-2026-705857.0Use after free in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to execute code locally.CVE-2026-705868.8Heap-based buffer overflow in Windows Paint allows an unauthorized attacker to execute code over a network.CVE-2026-705877.5Improper null termination in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.CVE-2026-705885.0Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitCVE-2026-705894.8Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offeCVE-2026-70595.3A vulnerability was found in 666ghj MiroFish up to 0.1.2. This affects the function get_simulation_posts of the file backend/app/api/simulatCVE-2026-705904.8Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff useCVE-2026-705914.1Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed
CVE-2026-70580: High severity, CVSS 8.8 | Vulnix