CVE-2026-68846: Windows Kernel Elevation of Privilege Vulnerability

Microsoft’s advisory describes a use-after-free condition in the Windows Kernel that allows an authorized attacker to elevate privileges over a network. The weakness is classified as CWE-416. A successful attacker could gain SYSTEM privileges, the highest local privilege level on a Windows device.

A race condition with a high-impact outcome​

The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. It indicates network reachability, low attacker privileges, required user interaction, and high potential impact on confidentiality, integrity, and availability.

Microsoft’s official advisory says exploitation requires an attacker to win a race condition, which is why the CVSS metric assigns high attack complexity, or AC:H. That constraint can make reliable exploitation harder than for a straightforward kernel bug, but it does not reduce the privilege gained if the attack succeeds: Microsoft says the result can be SYSTEM privileges.

The advisory’s risk assessment is Exploitation More Likely. Publicly disclosed: No. Exploited: No. These fields make patch deployment the practical control; organizations should not treat the absence of known exploitation as a reason to defer an update for a kernel-level privilege-escalation issue.

Why the affected footprint deserves attention​

CVE-2026-68846 spans current Windows 11 branches, Windows Server 2025, and older Windows 10 and Windows Server releases. The inclusion of Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019 means patch owners should check legacy server maintenance rings rather than assuming this is confined to modern desktop deployments.

Microsoft’s wording also identifies this as a network-reachable attack path, while requiring an authorized attacker and user interaction. In operational terms, the vulnerability is most relevant where an attacker has already obtained a foothold or valid access and can induce the necessary interaction. A successful race-condition exploit would then turn restricted access into SYSTEM-level control.

Windows 10 and Windows 11 update targets​

Install the listed update and validate that the endpoint reaches Microsoft’s fixed build:

Windows Server update targets​

Server Core installations are explicitly included for every affected Windows Server generation in Microsoft’s advisory. Patch-management inventories must therefore include Core systems rather than relying on GUI-server reporting alone.

Verify builds rather than only update approval​

Microsoft’s September 8 advisory establishes the KB-to-build mappings, which gives administrators a more useful completion test than merely confirming an update was offered or approved. Inventory reports should identify the installed Windows version and architecture, confirm the matching KB deployment, and verify the resulting build against the fixed-build target above.

For CVE-2026-68846, the immediate consequence of incomplete patching is clear: a user with authorized access could potentially turn that access into SYSTEM privileges by exploiting a Windows Kernel use-after-free race condition. The remedy is the applicable KB and fixed build for each client, server, architecture, and Server Core configuration listed by Microsoft.