CVE-2026-69802

CVE-2026-69802 is a weak-authentication flaw (CWE-1390) in Microsoft Network Device Enrollment Service (NDES). An unauthorized attacker can reach a vulnerable NDES service over the network and execute code, with high impact to confidentiality, integrity, and availability; the CVSS 3.1 score is 8.1 because attack complexity is high and no privileges or user interaction are required. NDES is the Windows enrollment service typically deployed with Active Directory Certificate Services for network-device certificate enrollment. The advisory data does not list specific product versions. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Install Microsoft's October 2026 security updates that address CVE-2026-69802 on any server where Network Device Enrollment Service is installed. Until the update is applied, do not expose NDES to untrusted networks and restrict enrollment access to known clients. Confirm whether the NDES role is enabled and review its authentication configuration.