CVE-2026-69802 – Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability

Microsoft has addressed a critical Remote Code Execution (RCE) vulnerability in the Network Device Enrollment Service (NDES), identified as CVE-2026-69802. The vulnerability exists because of weak authentication mechanisms that could allow an unauthorized attacker to execute malicious code remotely over a network. Successful exploitation could compromise the confidentiality, integrity, and availability of affected Windows Server systems. Although exploitation requires complex conditions, attackers do not need existing privileges or user interaction to launch an attack. The vulnerability affects multiple Windows Server versions, including Windows Server 2012 through Windows Server 2025.

CVSS SCORE: 8.1

SEVERITY: Critical

Threat

This vulnerability presents a significant security threat to organizations using Microsoft Network Device Enrollment Service (NDES).

An attacker could exploit weak authentication controls to execute unauthorized code on an affected Windows Server system over a network.

The vulnerability is particularly concerning because attackers do not require authentication privileges or assistance from legitimate users.

Successful exploitation could result in:

• Unauthorized Code Execution: Attackers could execute malicious code on vulnerable Windows servers.
• Sensitive Information Exposure: Confidential information stored or processed by affected systems could be compromised.
• System Integrity Compromise: Attackers could make unauthorized changes to systems or information.
• Service Disruption: Successful attacks could affect server availability and interrupt business operations.
• Critical Infrastructure Exposure: Organizations relying on affected Windows Server systems could face significant operational and security risks.

Although the attack complexity is rated High, the potential consequences remain severe.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

At the time of publication:

• Publicly Disclosed: No
• Actively Exploited: No
• Exploit Code Maturity: Unproven
• Public Exploit or PoC: The existence of publicly available exploit code or proof-of-concept code is not confirmed.
• Zero-Day Exploitation: No known active zero-day exploitation is reported.

The vulnerability requires high attack complexity, meaning attackers must overcome specific technical challenges and satisfy precise conditions to exploit it successfully.

However, the absence of known exploitation does not eliminate the security risk.

Technical Summary

CVE-2026-69802 is a Remote Code Execution vulnerability affecting Microsoft’s Network Device Enrollment Service (NDES).

The vulnerability is associated with CWE-1390: Weak Authentication, indicating that weaknesses in authentication controls could allow unauthorized attackers to execute code remotely.

NDES is the affected Microsoft service, and the vulnerability can be exploited through a network connection.

The underlying issue involves insufficient authentication protection, potentially allowing malicious requests to bypass intended security restrictions.

The precise authentication failure and technical steps required for exploitation are not specified.

The vulnerability has the following technical characteristics:

• Attack Vector: Network (AV:N) – Attackers can attempt exploitation remotely over a network.
• Attack Complexity: High (AC:H) – Successful exploitation requires specific conditions and considerable effort.
• Privileges Required: None (PR:N) – Attackers do not need existing authentication privileges.
• User Interaction: None (UI:N) – Exploitation does not require a user to open a file, click a link, or perform another action.
• Scope: Unchanged (S:U) – The impact remains within the affected security authority.
• Confidentiality Impact: High – Successful exploitation could expose sensitive information.
• Integrity Impact: High – Attackers could compromise the integrity of affected systems.
• Availability Impact: High – Exploitation could disrupt affected services or systems.

The vulnerability carries a CVSS v3.1 base score of 8.1, reflecting the potentially serious consequences of successful exploitation.

While the high attack complexity may limit exploitation opportunities, the lack of required privileges and user interaction increases the importance of addressing this weakness.

Exploitability

The vulnerability affects the following Microsoft Windows Server versions:

• Windows Server 2012 – KB5126835
• Windows Server 2012 R2 – KB5126836
• Windows Server 2016 – KB5126868
• Windows Server 2019 – KB5126651
• Windows Server 2022 – KB5126655
• Windows Server 2025 – KB5126646

Server Core installations are also affected across all listed versions.

An unauthorized attacker could potentially exploit weak authentication in NDES to execute malicious code remotely.

Exploitation requires complex conditions, and Microsoft considers successful exploitation less likely.

Business Impact

CVE-2026-69802 presents a serious risk to organizations operating affected Windows Server environments, particularly where Network Device Enrollment Service is deployed.

Successful exploitation could allow attackers to execute unauthorized code, potentially compromising critical server operations.

The business consequences could include:

• Security Breaches: Unauthorized code execution could compromise systems handling sensitive organizational information.
• Operational Disruption: Compromised servers could experience service interruptions, affecting business-critical applications.
• Data Confidentiality Risks: Attackers could potentially gain access to sensitive business information.
• System Integrity Risks: Unauthorized modifications could affect the reliability and trustworthiness of affected systems.
• Financial and Reputational Damage: Security incidents could result in recovery expenses, operational downtime, and loss of customer confidence.

Organizations that depend on affected Windows servers for critical services could face particularly serious consequences.

A single compromised server can put critical business operations at risk, even when the initial attack is difficult to execute.

Workaround

Microsoft has not identified any official mitigations or workarounds for this vulnerability.

Organizations should prioritize installing the appropriate security updates.

If immediate patching is not possible, consider these general risk-reduction measures:

• Restrict network access to NDES servers to trusted systems where operationally possible.
• Limit unnecessary network exposure of affected services.
• Monitor affected servers for suspicious authentication attempts and unusual activity.
• Apply network segmentation to reduce exposure.

These measures are general security precautions and are not confirmed fixes for this vulnerability.

A system restart is required after installing the applicable security update.

Urgency

Critical Severity – Prioritize Security Patch Deployment

CVE-2026-69802 should receive high patching priority because successful exploitation could allow unauthorized remote code execution on affected Windows servers.

Although Microsoft considers exploitation less likely and reports no known active exploitation, several factors make this vulnerability particularly concerning.

Attackers do not require existing privileges or user interaction, and successful exploitation could significantly affect confidentiality, integrity, and availability.

The vulnerability also affects multiple Windows Server generations, including Server Core installations, potentially increasing exposure across enterprise environments.

Organizations should prioritize identifying affected systems, evaluating their exposure, and deploying the relevant Microsoft security updates.

The attack may be difficult, but the consequences could be severe. Patching early helps prevent a complex vulnerability from becoming a costly security incident.