Microsoft Windows: Local privilege escalation in Credential Manager

Summary

A race condition (CWE-362, CWE-416) in the Windows Credential Manager allows an authorized local user to elevate privileges. An attacker needs a valid low-privilege account and local access, and attack complexity is high. The NVD CPE lists only Windows 10 version 1607, while Microsoft's CNA data lists several other Windows client and server versions as affected. The CVSS 3.1 base score is 7.0 (High).

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 before 10.0.14393.9612)
• Other versions per CNA data: Windows 10 1809, 21H2 and 22H2; Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2; Windows Server 2012, 2012 R2 and 2016 (including Server Core installations)

Fixed in

• Windows 10 1607: KB5126868 (build 14393.9612), released October 13, 2026
• Windows 10 1607: KB5134123 (build 14393.9615), out-of-band, released October 26, 2026; newest 1607 build, its scope for this CVE is not verified
• Other versions: fixed builds per CNA data, e.g. 1809 build 17763.9376, 21H2 and 22H2 build 19044.7807 and 19045.7807, Windows 11 23H2 build 22631.7652, 24H2 and 26H2 build 26100.9711 and 26300.9711, Server 2012 build 6.2.9200.26434, Server 2012 R2 build 6.3.9600.23470, Server 2016 build 14393.9612

Workaround

Unknown. No vendor-documented workaround found.

• Generic measures (not vendor-documented): limit local interactive logons and remove unneeded local accounts

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total
• Not listed in the CISA KEV catalog
• EPSS about 0.2% in recent snapshots
• No public proof-of-concept found in research; this does not rule one out

Our recommendation

• Install KB5134123 (build 14393.9615) on all Windows 10 1607 systems now, or at least KB5126868.
• Windows 10 1607 reached end of updates on October 13, 2026. Plan to replace or retire these devices. Paid Extended Security Updates availability is unknown.
• Check all other listed Windows versions and install the fixed builds.
• Restrict local accounts and interactive logons on shared machines and monitor for signs of privilege escalation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-69736 msrc.microsoft.com
• Microsoft KB5126868: Windows 10 1607 security update support.microsoft.com
• Microsoft KB5134123: Windows 10 1607 update support.microsoft.com
• Microsoft: Windows 10 1607 and Windows Server 2016 release health status learn.microsoft.com
• OpenCVE: CVE-2026-69736 app.opencve.io
• Vulners NVD: CVE-2026-69736 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:35.