Microsoft disclosed an out-of-bounds read in the Windows Event Logging Service that allows an unauthorized attacker to execute code over a network, rated CVSS 9.8 (Critical).
What Is It
CVE-2026-69493 is an out-of-bounds read in the Windows Event Logging Service. Per Microsoft's description, the flaw "allows an unauthorized attacker to execute code over a network." The CVE was published on 2026-09-08 by Microsoft ([email protected]) and currently carries an NVD status of "Awaiting Analysis."
The Microsoft-assigned CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scoring 9.8 / Critical.
Why It Matters
The vector describes the worst realistic combination for a Windows service bug: network-reachable, low attack complexity, no privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability. That means an attacker who can reach the affected service over the network needs no credentials and no help from a user to reach code execution.
The affected component is also notable. Event Logging is a core Windows service that is generally present and running by default on typical client and server installations, so exposure is unlikely to be limited to an optional role or add-on product. Hardened or heavily customized builds may differ, and administrators should confirm service state in their own environments.
CVE-2026-69493 does not currently appear in CISA's Known Exploited Vulnerabilities catalog, so active exploitation is not confirmed at this time.
What's Vulnerable
Microsoft lists the following affected products, fixed at the builds shown:
- Windows 10 1607 and Windows Server 2016 (incl. Server Core), before 10.0.14393.9512
- Windows 10 1809 and Windows Server 2019 (incl. Server Core), before 10.0.17763.9245
- Windows 10 21H2 / 22H2; before 10.0.19044.7725 / 10.0.19045.7725
- Windows 11 23H2 (x64, ARM64), before 10.0.22631.7582
- Windows 11 24H2; before 10.0.26100.9445
- Windows 11 25H2; before 10.0.26200.9445
- Windows 11 26H1; before 10.0.28000.2954
- Windows Server 2012 and 2012 R2 (incl. Server Core), before 6.2.9200.26349 / 6.3.9600.23397
- Windows Server 2022; before 10.0.20348.5622
- Windows Server 2025 (incl. Server Core), before 10.0.26100.33438
One caveat on the build list: Windows Server 2025 and Windows 11 24H2 share the 26100 build base and servicing branch, yet the advisory data shows two very different revision numbers for them (10.0.26100.33438 and 10.0.26100.9445). Both values are reproduced here as published, but administrators validating patch level on 26100-based systems should confirm the applicable revision directly against the MSRC entry for their specific product before treating a machine as fixed.
Coverage spans 32-bit, x64, and ARM64 platforms depending on the release.
Patch Status
Microsoft has published fixed build numbers for each affected release listed in the advisory, which indicates updates are available for those products. Patch to at or above the listed build for each product. No CISA KEV due date or additional required action applies to this CVE at present.
Sources
- Microsoft MSRC Update Guide; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69493
- NVD, CVE-2026-69493, https://nvd.nist.gov/vuln/detail/CVE-2026-69493
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog