CVE-2026-69864

Windows Hello Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 18th percentile. Fixed versions are out.

CVSS 3.17.8High EPSS percentile18th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix2 products6 fixed builds listed below

Published 2026-09-08Updated 2026-09-16Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Microsoft Windows 10 Version 21H2Affected: ≥ 10.0.19044.0, < 10.0.19044.7725Upgrade to: 10.0.19044.7725Affected: ≥ 10.0.19045.0, < 10.0.19045.7725Upgrade to: 10.0.19045.7725Stated by: CVE record
Microsoft Windows 11 version 23H2Affected: ≥ 10.0.22631.0, < 10.0.22631.7582Upgrade to: 10.0.22631.7582Affected: ≥ 10.0.26100.0, < 10.0.26100.9445Upgrade to: 10.0.26100.9445Affected: ≥ 10.0.26200.0, < 10.0.26200.9445Upgrade to: 10.0.26200.9445Affected: ≥ 10.0.28000.0, < 10.0.28000.2954Upgrade to: 10.0.28000.2954Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your Windows version/build number on each affected PC (Settings → System → About, or run winver).
Compare it to the fixed versions: Windows 10 must be at 10.0.19044.7725 or 10.0.19045.7725, and Windows 11 must be at 10.0.22631.7582 or later (including 10.0.26100.9445, 10.0.26200.9445, or 10.0.28000.2954).
Open Windows Update and install the latest available updates, specifically the Microsoft security update for CVE-2026-69864.
If you can’t update immediately, disable Windows Hello on that device until updates are applied, and ensure only trusted users have interactive access.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

This Windows Hello security flaw lets an attacker with access to your Windows account gain higher privileges on the same machine, so you should update if you use Windows Hello on Windows 10 or Windows 11.

CVE-2026-69864 is a Windows Hello local elevation-of-privilege flaw (CWE-416 use-after-free) that can let an authorized attacker trigger a memory-handling error and run with higher privileges on the affected device; this is not known to be listed in CISA KEV and no public exploit code is recorded.

If you're affected

Account takeover on your PC
Full control of the device
Wider access to business data

What is it

Windows Hello is the feature that lets you sign in using face, fingerprint, or a PIN. This vulnerability is like a mistake in how Windows temporarily stores information during that sign-in process—under certain conditions, someone already able to interact with your session could use it to gain higher privileges on that PC.

Who is affected

This matters if your business uses Windows 10 or Windows 11 devices with Windows Hello (PIN/biometric) enabled and users can sign in locally. It’s mainly a risk when an attacker already has some legitimate access to the machine (for example, an account they can use on the device) and can trigger the Windows Hello behavior on that same system.

How urgent is it

Treat this as urgent because it is a local privilege escalation flaw in Windows Hello: once someone has a foothold on the device, they may be able to raise privileges further. Even though CISA KEV does not list it and no public exploit code is known, the vulnerability targets a core sign-in component and the availability of updates means you should prioritize patching on affected endpoints now.

What to do — in detail

Confirm whether you’re exposed

On each Windows 10/Windows 11 PC, check the OS build:
- Go to Settings → System → About and note the Version and OS build; or run winver.
Determine whether the device uses Windows Hello (commonly Windows Hello PIN, face, or fingerprint) by checking Settings → Accounts → Sign-in options.

Patch to the fixed builds (per device)

Windows 10 is fixed at:
- 10.0.19044.7725 or 10.0.19045.7725.
Windows 11 is fixed at:
- 10.0.22631.7582 or later, including:
- 10.0.26100.9445, 10.0.26200.9445, and 10.0.28000.2954.

Upgrade approach

Install the Microsoft security update for CVE-2026-69864 via Windows Update (or your normal enterprise update mechanism).
Re-check winver after patching to verify the build number matches the fixed versions above.

If patching is delayed (temporary mitigation)

Reduce the chance of triggering the issue by disabling Windows Hello on affected devices until updates are applied (or require standard password sign-in instead).
Limit who can access the affected endpoints (strong account controls and minimizing local interactive access).

What to monitor

After updates, review sign-in and account activity logs for unusual local sign-in attempts on systems where Windows Hello is enabled.

KEV timing note

This CVE is not listed in CISA KEV based on the provided findings, so exploit status is not confirmed via KEV; still, patch because it targets local privilege escalation in a sign-in component.

Technical context

CVE-2026-69864 is a Windows Hello elevation of privilege vulnerability that maps to CWE-416 (use-after-free), meaning the Windows Hello code path can end up using memory that has been freed, which may allow manipulation of program behavior. The findings indicate it is a local risk involving an authorized attacker (someone who already has an account/session context on the device) rather than a remote unauthenticated attack. The provided findings show no public exploit code on record and no CISA KEV entry; press attention by Qualys exists, and the remediation guidance is available via Microsoft’s update guide. Fixes are available as specific OS build numbers for Windows 10 and Windows 11.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS18th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 18th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 8 days, from the signal feeds we watch.

2026-09-16Patch availablerecord updated
2026-09-10OpenVAS check added
2026-09-09Record updatedrecord updated
2026-09-08Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- Windows 10 Version 21H2OSOn-premOperating Systems / windows
- Windows 11 version 23H2OSOn-premOperating Systems / windows

And 11 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable