CVE-2026-69799 – Windows Hello Elevation of Privilege Vulnerability

CVE-2026-69799 is a critical elevation-of-privilege vulnerability in Windows Hello caused by improper synchronization when a shared resource is accessed concurrently. An authorized local attacker with low privileges could exploit a race condition to gain Virtual Trust Level 1 (VTL1) privileges. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: The vulnerability creates a local privilege-escalation threat. Exploitation requires an attacker with low privileges to successfully win a race condition. No user interaction is required, but the attack complexity is rated High.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as Unproven, and the exploitability assessment is Exploitation Unlikely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: Windows Hello contains a concurrent execution weakness involving a shared resource with improper synchronization (CWE-362), resulting in a race condition. An authorized attacker with local access and low privileges must successfully win this race condition to exploit the vulnerability. Successful exploitation could elevate the attacker’s privileges to Virtual Trust Level 1 (VTL1). The CVSS scope is Changed, with High potential impact to confidentiality, integrity, and availability. No user interaction is required.

EXPLOITABILITY: Affected software includes Windows 10 versions 21H2 and 22H2 for the listed 32-bit, ARM64, and x64 systems, and Windows 11 versions 23H2, 24H2, 25H2, and 26H1 for the listed ARM64 and x64 systems. Exploitation requires local access, low privileges, and successfully winning a high-complexity race condition.

BUSINESS IMPACT: Successful exploitation could allow a low-privileged local attacker to gain VTL1 privileges, creating significant risk to protected systems and information. With High confidentiality, integrity, and availability impacts, exploitation could undermine security boundaries and increase the damage possible from an already compromised or malicious local account.

WORKAROUND: No mitigations or workarounds are specified. An official fix is identified in the source data, so affected systems should be updated where possible.

URGENCY: This vulnerability is rated Critical and can result in privilege elevation with High confidentiality, integrity, and availability impacts. Although exploitation is assessed as unlikely and no exploitation is reported, affected Windows systems should be prioritized for deployment because no workaround or mitigation is specified.