Microsoft disclosed CVE-2026-69824, a CVSS 9.8 integer underflow in Microsoft Standard XPS that allows an unauthorized attacker to execute code over a network across nearly every supported Windows client and server release.
What Is It
CVE-2026-69824 is an integer underflow (wrap or wraparound) in Microsoft Standard XPS. Per Microsoft's description, the flaw "allows an unauthorized attacker to execute code over a network." The CVE was published on 2026-09-08 by Microsoft ([email protected]) and currently carries an NVD status of "Awaiting Analysis."
Why It Matters
Microsoft assigned a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every element of that vector is worst-case for a remote flaw: network attack vector, low complexity, no privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability. As scored, that vector describes an attacker who can reach an affected system over the network achieving code execution without credentials or user interaction; though the score reflects Microsoft's assessment rather than a demonstrated exploit, and no public proof-of-concept or technical write-up is available to confirm how readily the flaw can be triggered in practice.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation and no federal remediation deadline at this time.
What's Vulnerable
Microsoft lists an unusually broad affected set spanning 32-bit, x64, and ARM64 platforms:
- Windows 10: 1607 (< 10.0.14393.9512), 1809 (< 10.0.17763.9245), 21H2 (< 10.0.19044.7725), 22H2 (< 10.0.19045.7725)
- Windows 11: 23H2 (< 10.0.22631.7582), 24H2 (< 10.0.26100.9445), 25H2 (< 10.0.26200.9445), 26H1 (< 10.0.28000.2954)
- Windows Server: 2012 (< 6.2.9200.26349), 2012 R2 (< 6.3.9600.23397), 2016 (< 10.0.14393.9512), 2019 (< 10.0.17763.9245), 2022 (< 10.0.20348.5622), 2025 (< 10.0.26100.9445)
Windows Server 2025 and Windows 11 24H2 are both listed against the same 26100 build base and the same fixed revision, 9445. That pairing is consistent with the two products being serviced by a shared cumulative update, but the source material does not state the servicing relationship directly; administrators should confirm the correct update package for each product rather than assume a single patch covers both.
Server Core installations of Server 2012, 2012 R2, 2016, 2019, and 2025 are affected on the same builds.
Patch Status
The affected version ranges are bounded by fixed build numbers, indicating updates are available. Patch to at or above the listed build for each product and platform. Consult the Microsoft Security Response Center advisory for the specific update package matching your build. No workarounds or mitigations were provided in the supplied source material.
Sources
- Microsoft Security Response Center; CVE-2026-69824: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69824
- NVD, CVE-2026-69824: https://nvd.nist.gov/vuln/detail/CVE-2026-69824