Windows Enterprise App Management: Use-after-free privilege escalation

Summary

A use-after-free weakness (CWE-416) in the Windows Enterprise App Management component allows an authorized attacker to elevate privileges over a network. Affected are several supported and unsupported Windows 10, Windows 11 and Windows Server versions, including Windows 10 1607 and Windows Server 2016. The attack is considered highly complex, requires valid low-privileged credentials and user interaction, and has a high impact on confidentiality, integrity and availability (CVSS 7.1).

Affected

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.0 to below 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.0 to below 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2 and Windows Server 2025: 10.0.26100.0 to below 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to below 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to below 10.0.26300.9711
• Windows Server 2012 (including Server Core): 6.2.9200.0 to below 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to below 6.3.9600.23470

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: Unknown. Verify the fixed build in the MSRC Security Update Guide.
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9376 or later (October 2026 update, KB5126651)
• Other listed versions: build at or above the upper limit listed under affected, as released in the October 2026 update
• Windows Server 2012 and 2012 R2: Unknown. Verify in the MSRC Security Update Guide.

Workaround

Unknown. No vendor-documented workaround was found.

Exploitation

• No public proof of concept or exploit found.
• Not listed in the CISA KEV catalogue.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• EPSS is low (about 0.66% at last update).

Our recommendation

• Identify any Windows 10 1607 hosts and check whether they still receive security updates. Windows 10 LTSB 2016 may reach end of support on 13 October 2026; check Microsoft's lifecycle page.
• Install the October 2026 security update on all supported Windows systems, and confirm the fixed build for Windows 10 1607 in the MSRC Security Update Guide.
• Replace or isolate unsupported systems that cannot be patched.
• Limit local accounts and privileges, and monitor for unusual privilege escalation or lateral movement.
• Priority: medium if 1607 hosts exist, low otherwise.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-69452 msrc.microsoft.com
• NVD mirror (vulners): CVE-2026-69452 vulners.com
• OpenCVE: CVE-2026-69452 app.opencve.io
• Qualys: October 2026 Patch Tuesday review blog.qualys.com
• Positive Technologies: PT-2026-112054 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 14:25.