CVE-2026-69712: Windows Key Distribution Center Remote Code Execution Vulnerability

Microsoft assigns CVE-2026-69712 a Critical severity rating, with a CVSS base score of 8.8 and a CVSS temporal score of 7.7.

• CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• CWE: CWE-416
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes
• Exploitation assessment: Exploitation Less Likely

Microsoft’s advisory states: “Windows Key Distribution Center Remote Code Execution Vulnerability: Use after free in Windows Key Distribution Center allows an authorized attacker to execute code over a network.”

What an attacker needs​

This is not an unauthenticated drive-by attack. Microsoft says an authenticated attacker with low-level access to an affected server could send a specially crafted request to execute code on that server. User interaction is not required.

That prerequisite matters, but it should not encourage complacency. Code execution on a server responsible for key-distribution functions is a serious outcome: the CVSS vector reflects network reachability, low attack complexity, and potential high impact to confidentiality, integrity, and availability. Put plainly, an attacker who has already gained a suitable foothold may have a route to substantially deepen that compromise.

Affected Windows Server versions and fixes​

The update path differs by Windows Server release, but Server Core and full installation variants use the same applicable KB and fixed build for each generation. Administrators should deploy the listed update and confirm that the server reaches the corresponding build.

Required remediation​

For Windows Server 2012 (Server Core installation) (x64), install KB5123065 to reach fixed build 6.2.9200.26349. For Windows Server 2012 (x64), install KB5123065 to reach fixed build 6.2.9200.26349.

For Windows Server 2012 R2 (Server Core installation) (x64), install KB5123066 to reach fixed build 6.3.9600.23398. For Windows Server 2012 R2 (x64), install KB5123066 to reach fixed build 6.3.9600.23398.

For Windows Server 2016 (Server Core installation) (x64), install KB5123099 to reach fixed build 10.0.14393.9512. For Windows Server 2016 (x64), install KB5123099 to reach fixed build 10.0.14393.9512.

For Windows Server 2019 (Server Core installation) (x64), install KB5122876 to reach fixed build 10.0.17763.9245. For Windows Server 2019 (x64), install KB5122876 to reach fixed build 10.0.17763.9245.

For Windows Server 2022 (Server Core installation) (x64), install KB5122882 to reach fixed build 10.0.20348.5622. For Windows Server 2022 (x64), install KB5122882 to reach fixed build 10.0.20348.5622.

For Windows Server 2025 (Server Core installation) (x64), install KB5122871 to reach fixed build 10.0.26100.33438. For Windows Server 2025 (x64), install KB5122871 to reach fixed build 10.0.26100.33438.

Administrators should treat this as a patch-and-verify exercise rather than a patch-and-pray exercise: identify the affected server release and installation type, deploy its assigned KB, then validate that the operating system build matches Microsoft’s fixed-build value.