CVE-2026-69712 – Windows Key Distribution Center Remote Code Execution Vulnerability

CVE-2026-69712 is a critical use-after-free vulnerability in the Windows Key Distribution Center (KDC). An authenticated attacker with low-level access to an affected server could send a specially crafted request over the network and execute code on that server. Successful exploitation could have a high impact on confidentiality, integrity, and availability, and no user interaction is required.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability creates a network-based remote code execution threat against affected Windows Server systems. Attack complexity is low, although the attacker must be authenticated with low-level privileges. Successful exploitation could allow code execution and result in significant compromise of the targeted server.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-69712 is caused by a use-after-free memory condition (CWE-416) in the Windows Key Distribution Center. An authenticated attacker with low-level access could send a specially crafted request to an affected server over the network, triggering the vulnerability and executing code. The attack requires low privileges but has low attack complexity and requires no user interaction. A successful attack can have a high impact on the confidentiality, integrity, and availability of the affected server.

EXPLOITABILITY: Affected products include Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their listed Server Core installations. An authenticated attacker with low privileges can exploit the issue remotely using a specially crafted request. User interaction is not required.

BUSINESS IMPACT: Successful exploitation could allow an attacker to execute code on a vulnerable Windows Server, potentially exposing sensitive information, modifying systems or data, and disrupting server availability. For organizations relying on affected servers for critical services, server compromise could create significant operational and security consequences.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, and the affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical and carries a CVSS base score of 8.8. Its network attack vector, low attack complexity, low privilege requirement, and lack of required user interaction make timely deployment important. Although exploitation is assessed as Less Likely and no active exploitation is reported, affected Windows Servers should be prioritized for patching because successful exploitation can result in remote code execution with high confidentiality, integrity, and availability impact.