CVE-2026-69714

Think of the Windows Device Association Service as a “component” that helps devices connect and be recognized. This flaw could be used to trick Windows into giving an attacker higher privileges—like turning a user account into an administrator account—if the attacker can already get some foothold and then triggers the vulnerable condition.

This matters if you run Windows 10, Windows 11, or Windows Server (2012/2012 R2/2016/2019/2022/2025) in your business environment. It is most relevant when an attacker already has some level of authorization and can interact with the target (the findings indicate the attacker must be authorized and may require some user interaction).

This gets a RED urgency rating because the flaw can directly lead to privilege elevation, which is the kind of weakness attackers use to move from “some access” to full control. Even though there is no KEV listing and no public exploit code on record, the product area is core Windows functionality and the impact is high if it’s reached.