CVE-2026-69733: Untrusted search path privilege escalation in Windows Update · ZeroHour

CVE-2026-69733

mass

Untrusted search path privilege escalation in Windows Update

CVSS 3.1

7.8 high

EPSS

—

Published

Oct 13, 2026 (3d ago)

Modified

Oct 13, 2026

AI analysis

CVE-2026-69733 is an untrusted search path flaw (CWE-426) in Microsoft Windows Update. A locally authorized attacker with low privileges can cause Windows Update to load a file from an attacker-controlled location and thereby elevate privileges to high impact on confidentiality, integrity, and availability. The issue is local only (CVSS 3.1 base score 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and does not require user interaction. It affects Windows systems that use Windows Update; the advisory data does not list specific version ranges. It is not in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.

What to do: Install the latest Microsoft security updates that address CVE-2026-69733 as soon as they are available for your Windows builds, and confirm the fix in Microsoft's Security Update Guide. Until then, keep local accounts at least privilege and prevent untrusted users from writing files into directories Windows Update may search. There is no public proof-of-concept and the issue is not listed in CISA KEV.

Affected

Microsoft Windows Update

—

Estimated exposure

massOn the order of 1 billion+ Windows installations (estimate; exact vulnerable builds not published) — Windows Update ships with mainstream Windows client and server installations; public market-share figures put Windows on well over a billion devices, so the vulnerable component is plausibly present at mass scale even though the bug is…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.

Weakness: CWE-426
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-69733

In the news1 stories

Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)