CVE-2026-69475

CVE-2026-69475 is an untrusted pointer dereference (CWE-822) in Windows Remote Desktop Services, in which code dereferences a pointer to memory it does not reliably validate. It is triggered locally: an attacker who is already authorized to log on to the machine with low privileges can reach the vulnerable Remote Desktop Services code path without any user interaction. A successful exploit elevates the attacker's privileges on that host, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.8, High). Affected organizations are those running Windows systems with Remote Desktop Services enabled — most notably multi-user RDS session hosts and published-desktop/application servers, plus any Windows machine granting RDP logon to untrusted users — although the CVE record does not enumerate specific Windows versions, so Microsoft's advisory should be consulted for affected builds. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a low 0.3% probability of exploitation within 30 days, so it is not currently known to be exploited in the wild.

What to do: Apply Microsoft's security update addressing CVE-2026-69475 to all Windows systems with Remote Desktop Services or RDP enabled, prioritizing multi-user RDS session hosts and published-desktop servers where low-privileged users can log on and run code. Until patched, limit which accounts may log on locally or via RDP to these systems and watch for anomalous privilege-escalation activity, keeping in mind the low EPSS score does not rule out future weaponization. Track Microsoft's advisory for the exact affected version ranges, since the CVE record does not list specific builds.