CVE-2026-69846 – Windows Secure Kernel Mode Elevation of Privilege Vulnerability

CVE-2026-69846 is a critical elevation-of-privilege vulnerability in Windows Secure Kernel Mode caused by an integer overflow or wraparound. An authorized attacker who already has kernel-level access could submit a specially crafted Code Integrity policy and potentially execute code with Virtual Trust Level 1 (VTL1) privileges. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an attacker with existing kernel-level access to cross a security boundary and gain VTL1 privileges. Confidentiality, integrity, and availability impacts are all rated High, making successful exploitation potentially significant for a compromised Windows system.

EXPLOITS: The vulnerability is assessed as Exploitation Less Likely. It is not publicly disclosed and is not known to be exploited. Exploit Code Maturity is listed as Unproven; the source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY: The vulnerability results from an integer overflow or wraparound in Windows Secure Kernel Mode. An attacker who already has kernel-level access could submit a specially crafted Code Integrity policy to an affected machine. Successful exploitation could permit execution of code in Virtual Trust Level 1 (VTL1), resulting in elevation of privilege. The attack is local, has low attack complexity, requires high privileges, requires no user interaction, and changes security scope.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2016, 2019, 2022, and 2025, including the listed Server Core installations. Architectures vary by release and include affected 32-bit, x64, and ARM64 systems. Exploitation requires local access with existing kernel-level privileges and a specially crafted Code Integrity policy.

BUSINESS IMPACT: This vulnerability could deepen an existing system compromise by allowing an attacker with kernel-level access to reach VTL1 privileges. Successful exploitation carries High confidentiality, integrity, and availability impacts, creating risks to sensitive information, trusted system operations, and system availability. “A kernel compromise is serious; a path from the kernel into VTL1 can make that compromise even more powerful.”

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed for the vulnerability, and affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.2 and can result in VTL1 privilege elevation. Although exploitation is assessed as less likely, is not publicly disclosed, and is not currently known to be exploited, affected Windows systems should receive the official fix promptly because successful exploitation has High confidentiality, integrity, and availability impacts.