Microsoft Windows: Use after free in Wired AutoConfig Service

Summary

A use-after-free vulnerability in the Windows Wired AutoConfig Service allows an authorized local attacker to elevate privileges. The attacker needs valid low-privileged access to the affected Windows host, and no user interaction is required. Successful exploitation can result in full loss of confidentiality, integrity and availability on the host, but the flaw is not directly reachable from the internet.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (build 10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 and Windows Server 2019 (build 10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (build 10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (build 10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (build 10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 and 25H2, Windows 11 Version 26H2, Windows Server 2025 (build 10.0.26100.0 / 10.0.26200.0 / 10.0.26300.0 to before 9711 in the respective branch)
• Windows 11 Version 26H1 (build 10.0.28000.0 to before 10.0.28000.3231)
• Windows Server 2012 and Server Core installation (build 6.2.9200.0 to before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (build 6.3.9600.0 to before 6.3.9600.23470)

Fixed in

• Install the October 2026 security update for the affected Windows version.
• Fixed builds per the CVE record: 10.0.14393.9612 (1607 / Server 2016), 10.0.17763.9376 (1809 / Server 2019), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2 / Server 2025), 10.0.26200.9711 (25H2), 10.0.26300.9711 (26H2), 10.0.28000.3231 (26H1), 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2).
• Known update numbers: KB5126646 (Windows Server 2025) and KB5126651 (Windows 10 1809 / Server 2019). Other KB numbers are unknown; check the MSRC update guide.

Workaround

Unknown. No vendor-documented workaround was found.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Not publicly disclosed according to MSRC; no public proof of concept found.
• EPSS is very low (about 0.3%).

Our recommendation

• Install the October 2026 cumulative update on all affected Windows systems, prioritizing devices on Windows 10 1607 and other end-of-support builds.
• Check whether Windows 10 1607 devices are still supported and can receive updates; plan an upgrade if not.
• Limit local logons and standard-user rights on shared workstations and terminal servers.
• Verify the build numbers and KB list for your versions on the MSRC update guide before rollout.
• Monitor for an updated MSRC advisory stating exploitation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-69798 msrc.microsoft.com
• OpenCVE: CVE-2026-69798 app.opencve.io
• Vulners NVD mirror: CVE-2026-69798 vulners.com
• VulDB: CVE-2026-69798 vuldb.com
• Strix AI: CVE-2026-69798 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:51.