Microsoft’s description is direct: “Use after free in Windows Management Instrumentation allows an authorized attacker to elevate privileges over a network.” A successful attacker could obtain SYSTEM privileges—effectively the highest local privilege level on a Windows machine.
Risk assessment
| Field | Microsoft assessment |
|---|---|
| CVE | CVE-2026-69451 |
| Title | Windows Management Instrumentation Elevation of Privilege Vulnerability |
| Severity | Important |
| CVSS base score | 7.1 |
| CVSS temporal score | 6.2 |
| CVSS vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
| Weakness | CWE-416 |
| Publicly disclosed | Publicly disclosed: No |
| Exploited | Exploited: No |
| Exploitation assessment | Exploitation More Likely |
| Customer action | Customer action required: Yes |
The scoring tells a nuanced story. Exploitation requires network access, low privileges, and user interaction, while the AC:H rating means an attacker must possess a deep understanding of the target system. Microsoft notes that exploitation is not guaranteed and depends on a combination of factors, including the environment, system configuration, and any additional security measures in place.
That should not be mistaken for a reason to delay deployment. When the potential reward is SYSTEM-level access, attackers have considerable incentive to chain a low-privilege foothold with a privilege-escalation flaw. WMI is also widely used for administration and automation, making this a patch-management item that belongs on the priority list for endpoint and server administrators.
What makes CVE-2026-69451 significant
Use-after-free bugs occur when software continues trying to use memory after it has been released. In security terms, that can create an opening for an attacker to influence program behavior in ways its designers never intended. Memory safety bugs are famously fussy to exploit reliably—hence the high attack-complexity rating—but they can be extremely consequential when they occur in privileged Windows components.
For CVE-2026-69451, Microsoft says a successful exploit could grant SYSTEM privileges. SYSTEM is not merely an administrator account wearing a larger hat; it is a core Windows security context with broad control over the local device. The practical impact can include exposure of data, tampering with system configuration, and a far stronger foothold for a threat actor who already has authorized access.
The required conditions matter:
- The attacker must be authorized.
- The attack is performed over a network.
- The CVSS vector identifies low privileges required.
- User interaction is required.
- Microsoft rates exploitation as Exploitation More Likely despite the high-complexity requirement.
In other words, this is not described as a simple one-packet drive-by attack. But enterprise defenders should treat it as a potentially valuable second-stage vulnerability: the kind of issue that can turn a limited compromise into complete local control.
Affected Windows releases and fixed builds
The following Microsoft updates and build targets address CVE-2026-69451. Organizations should deploy the update matching their exact Windows release and architecture.
Windows 10
- For Windows 10 Version 1607 for 32-bit Systems (x86), install KB5123099 to reach fixed build 10.0.14393.9512.
- For Windows 10 Version 1607 for x64-based Systems, install KB5123099 to reach fixed build 10.0.14393.9512.
- For Windows 10 Version 1809 for 32-bit Systems (x86), install KB5122876 to reach fixed build 10.0.17763.9245.
- For Windows 10 Version 1809 for x64-based Systems, install KB5122876 to reach fixed build 10.0.17763.9245.
- For Windows 10 Version 21H2 for 32-bit Systems (x86), install KB5122878 to reach fixed build 10.0.19044.7725.
- For Windows 10 Version 21H2 for ARM64-based Systems, install KB5122878 to reach fixed build 10.0.19044.7725.
- For Windows 10 Version 21H2 for x64-based Systems, install KB5122878 to reach fixed build 10.0.19044.7725.
- For Windows 10 Version 22H2 for 32-bit Systems (x86), install KB5122878 to reach fixed build 10.0.19045.7725.
- For Windows 10 Version 22H2 for ARM64-based Systems, install KB5122878 to reach fixed build 10.0.19045.7725.
- For Windows 10 Version 22H2 for x64-based Systems, install KB5122878 to reach fixed build 10.0.19045.7725.
Windows 11
- For Windows 11 Version 23H2 for ARM64-based Systems, install KB5122880 to reach fixed build 10.0.22631.7582.
- For Windows 11 Version 23H2 for x64-based Systems, install KB5122880 to reach fixed build 10.0.22631.7582.
- For Windows 11 Version 24H2 for ARM64-based Systems, install KB5124008 to reach fixed build 10.0.26100.9445.
- For Windows 11 Version 24H2 for x64-based Systems, install KB5124008 to reach fixed build 10.0.26100.9445.
- For Windows 11 Version 25H2 for ARM64-based Systems, install KB5124008 to reach fixed build 10.0.26200.9445.
- For Windows 11 Version 25H2 for x64-based Systems, install KB5124008 to reach fixed build 10.0.26200.9445.
- For Windows 11 Version 26H1 for ARM64-based Systems, install KB5124012 to reach fixed build 10.0.28000.2954.
- For Windows 11 version 26H1 for x64-based Systems, install KB5124012 to reach fixed build 10.0.28000.2954.
Windows Server
- For Windows Server 2012 (Server Core installation) (x64), install KB5123065 to reach fixed build 6.2.9200.26349.
- For Windows Server 2012 (x64), install KB5123065 to reach fixed build 6.2.9200.26349.
- For Windows Server 2012 R2 (Server Core installation) (x64), install KB5123066 to reach fixed build 6.3.9600.23398.
- For Windows Server 2012 R2 (x64), install KB5123066 to reach fixed build 6.3.9600.23398.
- For Windows Server 2016 (Server Core installation) (x64), install KB5123099 to reach fixed build 10.0.14393.9512.
- For Windows Server 2016 (x64), install KB5123099 to reach fixed build 10.0.14393.9512.
- For Windows Server 2019 (Server Core installation) (x64), install KB5122876 to reach fixed build 10.0.17763.9245.
- For Windows Server 2019 (x64), install KB5122876 to reach fixed build 10.0.17763.9245.
- For Windows Server 2022 (Server Core installation) (x64), install KB5122882 to reach fixed build 10.0.20348.5622.
- For Windows Server 2022 (x64), install KB5122882 to reach fixed build 10.0.20348.5622.
- For Windows Server 2025 (Server Core installation) (x64), install KB5122871 to reach fixed build 10.0.26100.33438.
- For Windows Server 2025 (x64), install KB5122871 to reach fixed build 10.0.26100.33438.
Deployment priorities for administrators
The most important operational step is uncomplicated: identify devices on the affected releases, deploy the appropriate cumulative update, and confirm they have reached the listed fixed build. This applies to both full Windows Server installations and Server Core systems; the latter may have less graphical clutter, but they are not exempt from the vulnerability.
Prioritize systems where WMI is accessible across the network or routinely used in administrative workflows. That includes management servers, automation hosts, administrative workstations, jump servers, and endpoints used by privileged IT staff. Patching removes the listed vulnerability; maintaining disciplined access control and minimizing unnecessary privilege remain essential defenses against the sort of attack chain CVE-2026-69451 could support.
Microsoft’s advisory supplies the crucial bottom line: this is an Important WMI elevation-of-privilege vulnerability with a route to SYSTEM privileges, a 7.1 CVSS base score, and required customer action. The technical path may be demanding, but SYSTEM is a prize worth defending.
References
- Official MSRC or vendor evidence api.msrc.microsoft.com
- Official MSRC or vendor evidence msrc.microsoft.com
- Official MSRC or vendor evidence api.msrc.microsoft.com