CVE-2026-83939

CVE-2026-83939 is an untrusted pointer dereference (CWE-822) in the Windows Secure Kernel Mode, the high-privilege virtualization-based security component of Windows. A local attacker who is already authorized and holds high privileges on the system can trigger the flaw by causing the Secure Kernel to dereference an attacker-influenced pointer, gaining local elevation of privileges. Because the CVSS scope is 'changed' (S:C), the flaw lets an attacker cross a security boundary beyond the process they started in, with high impact on confidentiality, integrity and availability. Any Windows installation whose Secure Kernel component is affected is at risk, per Microsoft's September 2026 Patch Tuesday advisory; exact version ranges are listed in Microsoft's bulletin. There is no known in-the-wild exploitation, no public proof-of-concept, and a low 0.3% EPSS probability of exploitation in the next 30 days, but a fix shipped as part of the 974-vulnerability September 2026 release.

What to do: Install the September 2026 Windows security (cumulative) updates from Microsoft's Patch Tuesday release for every affected Windows version in your environment; do not skip workloads where virtualization-based security features (e.g., HVCI/Credential Guard) are enabled, as they rely on the affected Secure Kernel. Because the flaw requires an attacker to already hold high local privileges, treat it as a chaining/enabler risk for adversary-in-the-middle post-exploitation and prioritize patching hosts with many privileged users or admins. No workaround or mitigation is listed in the source data; check Microsoft's advisory for per-version applicability and any released mitigation guidance.