CVE-2026-69431

CVE-2026-69431 is a heap-based buffer overflow (CWE-122) in the Telnet Client, scored a critical 9.8 because it is exploitable over the network with no privileges, no user interaction, and low attack complexity. Because the flaw sits in client code, the realistic attack path is an attacker-controlled or man-in-the-middle Telnet server sending malformed responses that corrupt the client's heap when a victim connects, yielding remote code execution in the context of the logged-in user. The CNA is Microsoft, so the affected component is understood to be the Windows Telnet Client, a legacy optional Windows feature that is disabled by default on modern builds. No specific affected version ranges were provided in the source data, so defenders should treat any system with the feature installed as potentially affected until the vendor advisory clarifies. There is no known public proof-of-concept, no CISA KEV listing, and EPSS is low (0.9% / 58th percentile), indicating no observed in-the-wild exploitation to date.

What to do: Apply the relevant Microsoft security update as soon as it is released for your Windows versions. Audit for the Telnet Client optional feature (e.g., 'Get-WindowsCapability -Online -Name TelnetClient*' or 'Turn Windows features on or off') and remove or disable it wherever it is not required, migrating management traffic to SSH. Because exploitation requires the client to connect to attacker-influenced Telnet infrastructure, blocking outbound TCP port 23 at firewalls further reduces risk.