CVE-2026-69710

CVE-2026-69710 is a race condition (CWE-362) in Windows Hello, Microsoft's built-in biometric and PIN sign-in component, where concurrent access to a shared resource is not properly synchronized. An authorized attacker on the local machine can trigger the flaw by running operations that hit the unsynchronized window in Windows Hello, and the high attack complexity (AC:H) means success depends on winning a narrow timing race. The CVSS vector shows a changed scope with high confidentiality, integrity and availability impact, so a successful attack lets the attacker cross a security boundary and elevate privileges on the affected system. Because Windows Hello is an in-box part of modern Windows releases, any Windows device is potentially in scope, though the exact affected version list was not included in the available data. There is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns only a 0.2% probability of exploitation within 30 days, so no exploitation is currently known.

What to do: Install the Microsoft Windows security update that fixes this race condition as soon as it is offered via Windows Update, prioritizing devices with multiple or shared local administrative accounts. Check Microsoft's advisory for the definitive list of affected Windows versions. Until patched, apply least privilege to local accounts, since exploitation requires an already-authorized local user.