CVE-2026-69574

CVE-2026-69574 is a use-after-free memory-corruption flaw (CWE-416) in the Windows Device Association Service, a built-in Windows component. An authorized attacker who already has low-privileged code execution on the local machine can trigger the flaw without user interaction, although the attack requires high complexity. Successful exploitation elevates the attacker's privileges locally, with high impact on confidentiality, integrity, and availability (typically resulting in SYSTEM-level access). Any Windows system running the Device Association Service is affected; Microsoft has not disclosed exploitation in the wild, no public proof-of-concept is known, and the EPSS score is low (0.3% chance of exploitation in the next 30 days, 17th percentile).

What to do: Apply Microsoft's security update for CVE-2026-69574 when it is released, prioritizing multi-user hosts such as RDS/session servers and shared workstations where standard local accounts exist, since exploitation requires an authorized local user. Until patched, restrict local standard-user access on sensitive Windows hosts; there is no public PoC or in-the-wild exploitation, and the EPSS probability is low (0.3%).