CVE-2026-69874 – Windows ALPC Elevation of Privilege Vulnerability

CVE-2026-69874 is a Critical elevation-of-privilege vulnerability in Windows ALPC caused by an untrusted pointer dereference. An authorized local attacker who successfully exploits the flaw could elevate privileges to Virtual Trust Level 1 (VTL1). Exploitation requires high privileges and no user interaction. The vulnerability is not publicly disclosed or known to be exploited, and exploitation is assessed as unlikely.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: A successful attacker could elevate privileges locally and gain VTL1 privileges. The CVSS metrics identify high potential impact to confidentiality, integrity, and availability, with scope changed.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven, and the exploitability assessment is Exploitation Unlikely. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability results from an untrusted pointer dereference in Windows ALPC. An authorized attacker with local access and high privileges could attempt to exploit the flaw to elevate privileges. Successful exploitation could provide VTL1 privileges and result in high confidentiality, integrity, and availability impact. The CVSS metrics specify a local attack vector, low attack complexity, high privileges required, no user interaction, and changed scope. The accompanying FAQ states that exploitation requires deep knowledge of the system and is not guaranteed because success can depend on the environment, configuration, and additional security measures.

EXPLOITABILITY: Affected software includes Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1 across the listed architectures; and Windows Server 2019, 2022, and 2025, including the listed Server Core installations. Exploitation requires local access and high privileges; no user interaction is required.

BUSINESS IMPACT: Successful exploitation could allow an attacker who already has authorized local access and high privileges to gain VTL1 privileges. The resulting elevation could have serious consequences for sensitive systems because confidentiality, integrity, and availability impacts are all rated High. “Privilege escalation can turn an existing foothold into a much deeper compromise.”

WORKAROUND: No workaround or mitigation is listed. An official fix is identified, so affected systems should receive the applicable security update. The listed updates require a restart.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.2 and potentially high impact across confidentiality, integrity, and availability. Although exploitation is assessed as unlikely and no exploitation is reported, organizations should prioritize deployment of the official fix across affected Windows endpoints and servers.