CVE-2026-69809

High7.5 Published on Sep 8, 2026

Missing release of memory after effective lifetime in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.

CVSS score7.5 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness type (CWE)CWE-401

Vendorsmicrosoft

Affected products

Vendors	Product	Versions
microsoft	windows 11 23h2	< 10.0.22631.7582
microsoft	windows 11 24h2	< 10.0.26100.9445
microsoft	windows 11 25h2	< 10.0.26200.9445
microsoft	windows 11 26h1	< 10.0.28000.2954
microsoft	windows server 2022	< 10.0.20348.5622
microsoft	windows server 2025	< 10.0.26100.33438

Vulnerabilities

Microsoft Patches 966 Flaws as Two Windows Zero-Days Come Under Active Attack

Microsoft fixed 966 flaws in record September Patch Tuesday, including two exploited Windows privilege-escalation zero-days leading to SYSTEM access.

Sep 8, 202621:34 6 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

Microsoft Patches 966 Flaws as Two Windows Zero-Days Come Under Active Attack