Microsoft has disclosed a heap-based buffer overflow in the Windows RNDIS component that allows an unauthorized attacker to execute code over a network, rated CVSS 9.8 (Critical).
What Is It
CVE-2026-69768 is a heap-based buffer overflow in Windows RNDIS (Remote Network Driver Interface Specification). According to Microsoft's advisory, the flaw "allows an unauthorized attacker to execute code over a network."
The CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, describes the worst realistic combination for a remote flaw: network-reachable, low attack complexity, no privileges required, and no user interaction, with total loss of confidentiality, integrity, and availability. That produces a base score of 9.8 CRITICAL.
The CVE was published 2026-09-08 by Microsoft ([email protected]) and remains in "Awaiting Analysis" status at NVD.
Why It Matters
Pre-authentication remote code execution requiring no user interaction is the highest-value class of vulnerability for both commodity and targeted operators. The affected component spans essentially the entire supported Windows fleet, client and server, 32-bit, x64, and ARM64, which makes the exposed population very large.
As of 2026-09-08, CVE-2026-69768 does not appear in CISA's Known Exploited Vulnerabilities catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), so there is no federally confirmed active exploitation and no BOD 22-01 remediation deadline attached to it. Defenders should treat the catalog as the checkable source here and re-query it before assuming the status still holds.
What's Vulnerable
Microsoft lists the following affected products, patched at the builds shown:
Windows client - Windows 10 1607; before 10.0.14393.9512 - Windows 10 1809; before 10.0.17763.9245 - Windows 10 21H2 / 22H2; before 10.0.19044.7725 / 10.0.19045.7725 - Windows 11 23H2; before 10.0.22631.7582 - Windows 11 24H2; before 10.0.26100.9445 - Windows 11 25H2; before 10.0.26200.9445 - Windows 11 26H1; before 10.0.28000.2954
Windows Server (including Server Core installations) - Server 2012; before 6.2.9200.26349 - Server 2012 R2; before 6.3.9600.23397 - Server 2016; before 10.0.14393.9512 - Server 2019; before 10.0.17763.9245 - Server 2022; before 10.0.20348.5622 - Server 2025; build number unconfirmed; see note below
One caveat on Server 2025: the fixed build circulating for it, 10.0.26100.33438, cannot be reconciled with the Windows 11 24H2 figure above. Both products ship from the same 26100 servicing branch and therefore patch at the same revision, which is listed as 10.0.26100.9445 for 24H2. A revision of .33438 on that branch is not plausible alongside a .9445 sibling, so at least one of the two numbers is wrong. Verify the Server 2025 build directly in the MSRC update guide before using it as a patch-verification threshold; do not gate compliance checks on .33438.
Patch Status
Fixed builds are published for every affected product listed above. Apply the Microsoft update that brings each system to at or above the listed build, confirming the Server 2025 revision against MSRC first. Prioritize network-reachable servers and any host where RNDIS is exposed, given the unauthenticated network attack vector.
Sources
- Microsoft Security Response Center; CVE-2026-69768: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69768
- NVD, CVE-2026-69768: https://nvd.nist.gov/vuln/detail/CVE-2026-69768
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog