Microsoft has disclosed a critical heap-based buffer overflow in the Windows Telnet Client, tracked as CVE-2026-69431 with a CVSS 3.1 score of 9.8, allowing an unauthorized attacker to execute code over a network.
What Is It
CVE-2026-69431 is a heap-based buffer overflow in the Windows Telnet Client. Per Microsoft's advisory, the flaw "allows an unauthorized attacker to execute code over a network." The CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, places the attack over the network, at low complexity, with no privileges and no user interaction required, and full impact to confidentiality, integrity, and availability. That combination yields the 9.8 CRITICAL rating. The record was published 2026-09-08 by Microsoft ([email protected]) and remains in "Awaiting Analysis" status at NVD.
Why It Matters
An unauthenticated, network-reachable code execution path with no user interaction is the highest-risk class of vulnerability. The affected component spans nearly the entire supported Windows fleet, client and server, including Server Core installations, and reaches back to legacy platforms still common in industrial and enterprise estates.
Scoping the exposure matters as much as the score. The Telnet Client ships as an optional Windows feature rather than a default-enabled service, so real-world attack surface concentrates on hosts where it has been deliberately installed; administrative jump boxes, network-operations workstations, and OT/industrial environments where Telnet remains in routine use for device management. Inventorying which systems actually have the feature turned on is the fastest way to convert a fleet-wide CVSS 9.8 into a bounded remediation list.
CVE-2026-69431 does not appear in CISA's Known Exploited Vulnerabilities catalog as of 2026-09-08, so active exploitation is not confirmed at this time. Defenders should re-check the catalog directly, as entries are added as evidence of exploitation emerges.
What's Vulnerable
Microsoft lists the following as affected, in each case below the fixed build:
- Windows 10 1607 (< 10.0.14393.9512), 1809 (< 10.0.17763.9245), 21H2 and 22H2 (< 10.0.19044.7725 / 10.0.19045.7725)
- Windows 11 23H2 (< 10.0.22631.7582), 24H2 (< 10.0.26100.9445), 25H2 (< 10.0.26200.9445), 26H1 (< 10.0.28000.2954)
- Windows Server 2012 (< 6.2.9200.26349), 2012 R2 (< 6.3.9600.23397), 2016 (< 10.0.14393.9512), 2019 (< 10.0.17763.9245), 2022 (< 10.0.20348.5622), 2025; including Server Core installations
Windows Server 2025 shares the 26100 servicing branch with Windows 11 24H2, so the two track the same build lineage for this component. Administrators running Server 2025 should confirm the applicable build number against Microsoft's Security Update Guide rather than relying on a secondhand figure.
Affected platforms include 32-bit, x64-based, and ARM64-based systems depending on the product.
Patch Status
The version data indicates fixed builds are available for every affected product; administrators should update to at or above the listed build for their platform. Microsoft's Security Update Guide entry for CVE-2026-69431 is the authoritative source for the specific update packages and build numbers. Because the CVE is not currently listed in CISA's Known Exploited Vulnerabilities catalog, no BOD 22-01 remediation deadline applies to federal civilian agencies; patching should still be prioritized on the merits of the CVSS 9.8 rating and the unauthenticated attack path.
Where patching cannot be completed immediately, removing the Telnet Client optional feature from hosts that do not require it eliminates the vulnerable component outright, and egress filtering on TCP/23 limits reachable paths on hosts that still need it.
Sources
- Microsoft Security Response Center; Security Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69431
- NVD, CVE-2026-69431: https://nvd.nist.gov/vuln/detail/CVE-2026-69431
- CISA, Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog