"As of publication, CVE-2026-69769 does not appear in the CISA Known Exploited Vulnerabilities catalog, so active exploitation is not confirmed at this time and no federal remediation deadline applies. Defenders should…"

As of publication, CVE-2026-69769 does not appear in the CISA Known Exploited Vulnerabilities catalog, so active exploitation is not confirmed at this time and no federal remediation deadline applies. Defenders should re-check the catalog directly, since KEV status can change without notice and the absence of an entry reflects only what has been confirmed to date.

CVE-2026-69769: Critical Pre-Auth RCE in Windows HTTP Print Provider

Microsoft disclosed a heap-based buffer overflow in the Windows HTTP Print Provider that lets an unauthenticated attacker execute code over the network, rated CVSS 9.8 Critical.

What Is It

CVE-2026-69769 is a heap-based buffer overflow in the Windows HTTP Print Provider. Per Microsoft's description, the flaw "allows an unauthorized attacker to execute code over a network." The CVE was published on 2026-09-08 by Microsoft ([email protected]) and currently sits in NVD as "Awaiting Analysis."

Why It Matters

Microsoft assigned a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every parameter that matters for mass exploitation is present: network attack vector, low complexity, no privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability. That combination describes a pre-authentication remote code execution condition reachable over the network against a print-related service component.

What's Vulnerable

Microsoft lists a broad swath of supported and legacy Windows builds as affected, patched at the following build thresholds:

Windows 10 1607 (< 10.0.14393.9512), 1809 (< 10.0.17763.9245), 21H2 and 22H2 (< 10.0.19044.7725 / 10.0.19045.7725), 32-bit, x64, and ARM64 where applicable
Windows 11 23H2 (< 10.0.22631.7582), 24H2 (< 10.0.26100.9445), 25H2 (< 10.0.26200.9445), 26H1 (< 10.0.28000.2954), x64 and ARM64
Windows Server 2012 and 2012 R2, including Server Core (< 6.2.9200.26349 / < 6.3.9600.23397)
Windows Server 2016 (< 10.0.14393.9512), 2019 (< 10.0.17763.9245), 2022 (< 10.0.20348.5622), and 2025, including Server Core installations

One caveat on Windows Server 2025: the fixed build recorded for it, 10.0.26100.33438, is inconsistent with the threshold given for Windows 11 24H2 (10.0.26100.9445) despite both products sharing the 26100 base build. Servicing for a shared base build does not normally diverge by that magnitude, so treat the Server 2025 revision number as unverified and confirm the exact build and KB against the MSRC update guide entry before using it as a patch-verification baseline.

Patch Status

Microsoft has published fixed builds for every affected product listed above; the update guide entry is the authoritative source for the specific KB per platform. Remediation is to update affected systems to at or above the listed build number. The supplied data contains no vendor workaround or mitigation guidance beyond patching.

Sources

Microsoft Security Response Center; Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69769
NVD, CVE-2026-69769: https://nvd.nist.gov/vuln/detail/CVE-2026-69769
CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog