CVE-2026-69890 – Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability

CVE-2026-69890 is a use-after-free vulnerability in the Windows Virtual Trusted Platform Module that allows an authorized local attacker to elevate privileges. Successful exploitation requires high existing privileges and winning a race condition, but could give the attacker Virtual Trust Level 1 (VTL1) privileges. No user interaction is required.

CVSS SCORE: 7.5.

SEVERITY: Critical.

THREAT: Successful exploitation could allow a local, highly privileged attacker to cross a security boundary and gain VTL1 privileges. The CVSS assessment identifies high potential impact to confidentiality, integrity, and availability, with scope changed.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploitation is assessed as unlikely, and exploit code maturity is rated Unproven. The existence of public exploit code, zero-day exploitation, or proof-of-concept code cannot be confirmed from the source data.

TECHNICAL SUMMARY: The vulnerability is caused by a use-after-free weakness (CWE-416) in the Windows Virtual Trusted Platform Module. An authorized attacker with high local privileges can attempt to trigger the flaw by successfully winning a race condition. Successful exploitation can result in elevation to Virtual Trust Level 1 (VTL1) privileges. The vulnerability has changed scope and is rated as having high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected software includes Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1 on the architectures listed in the affected-software data; and Windows Server 2019, 2022, and 2025, including listed Server Core installations. Exploitation requires local access, high privileges, and winning a race condition. No user interaction is required.

BUSINESS IMPACT: Organizations running affected Windows systems face the risk of a privileged attacker gaining VTL1 privileges. Successful exploitation could have serious consequences for sensitive information, system integrity, and service availability. Although exploitation is considered unlikely, compromise at this privilege level can significantly increase the impact of an existing foothold.

WORKAROUND: No workaround or mitigation is listed. An official fix is identified as the remediation, and affected systems require a restart after installation.

URGENCY: This vulnerability is rated Critical and can affect confidentiality, integrity, and availability at a high level. Although it is not known to be exploited and exploitation is assessed as unlikely, affected Windows systems should be prioritized for deployment of the official fix because successful exploitation could grant VTL1 privileges.