Vulnerabilities
CVE-2026-69840: Windows Certificates Use‑After‑Free Privilege Escalation Vulnerability
A use‑after‑free flaw in Windows Certificates can be exploited by an authenticated local user to gain elevated privileges. The issue affects all current Windows 10/11 and Windows Server releases until the latest cumulative update. Defenders should apply the patch immediately, enforce least‑privilege, and monitor certificate processing for anomalous activity.
What happened
A use‑after‑free bug in the Windows Certificates component allows an authenticated local user to trigger a memory corruption that can lead to privilege escalation. The flaw is triggered by malformed certificate data processed by the certsrv service.
Affected systems
- Windows 10 (all editions)
- Windows 11 (all editions)
- Windows Server 2016, 2019, 2022
Impact
Successful exploitation elevates the attacker’s privileges to SYSTEM, enabling full control over the host.
Mitigation
- Install the latest cumulative update that contains the fix (KBxxxxxx).
- Ensure Windows Update is enabled and automatic.
- Apply least‑privilege principles; restrict local user accounts from running certificate services.
- Consider disabling the certsrv service on servers that do not require it.
Detection
Monitor for anomalous certificate processing events (Event ID 1001, 1002) and unexpected use of certutil or certsrv.exe. Look for signs of memory corruption or crashes in the certsrv process.
Related vulnerabilities
CVE-2026-83690: Windows Kernel Use‑After‑Free Privilege Escalation
A local use‑after‑free flaw in the Windows kernel allows an attacker with local access to gain SYSTEM privileges. Microsoft has released a patch in the latest cumulative update. Defenders should apply the update immediately and enforce least‑privilege controls.
Read briefing
Windows Storage Use-After-Free Enables Local Privilege Escalation (CVE-2026-69763)
A use‑after‑free flaw in Windows Storage allows an authorized local user to elevate privileges. The vulnerability affects Windows 10, 11, Server 2019, and 2022. Defenders should apply the latest cumulative update and enforce least‑privilege policies.
Read briefing
CVE-2026-72955: Windows Application Compatibility Cache Use-After-Free Privilege Escalation
A local use‑after‑free flaw in the Windows Application Compatibility Cache allows an authenticated user to gain SYSTEM privileges. The vulnerability affects all Windows systems that use the cache and can be mitigated by installing the latest security updates. Defenders should verify patch status and monitor for anomalous privilege changes.
Read briefing
Windows Hello Use-After-Free Vulnerability (CVE‑2026‑83740) Enables Local Privilege Escalation
A use‑after‑free flaw in Windows Hello allows an attacker who already has local access to gain higher privileges. The issue is present in Windows 10/11 versions prior to the latest cumulative update. Defenders should apply the latest patches, disable Hello where not needed, and monitor for anomalous privilege changes.
Read briefing