CVE-2026-69923

Analyzed Analyzed - Analysis Complete

Uncontrolled Search Path Element in Windows AI

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Microsoft Corporation

Description

Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-69923

EUVD

EUVD-2026-99662

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_11_24h2	to 10.0.26100.9711 (exc)
microsoft	windows_11_24h2	to 10.0.26100.9711 (exc)
microsoft	windows_11_25h2	to 10.0.26200.9711 (exc)
microsoft	windows_11_25h2	to 10.0.26200.9711 (exc)
microsoft	windows_11_26h1	to 10.0.28000.3231 (exc)
microsoft	windows_11_26h1	to 10.0.28000.3231 (exc)
microsoft	windows_11_26h2	to 10.0.26300.9711 (exc)
microsoft	windows_11_26h2	to 10.0.26300.9711 (exc)
microsoft	windows_server_2025	to 10.0.26100.33650 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-427	The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled search path element in Windows AI that allows an authorized attacker to elevate their privileges locally. This means an attacker with some access could exploit this flaw to gain higher-level permissions on the system.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain elevated privileges on your system. This might let them install programs, view or delete data, or create new accounts with full user rights, potentially leading to complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access or privilege escalation, which may result in data breaches. Such breaches could violate compliance requirements under GDPR, HIPAA, or other regulations, potentially leading to legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply the latest Windows security updates from Microsoft to address the uncontrolled search path element in Windows AI. Monitor Microsoft's update guide for patches specific to CVE-2026-69923.

Hi! I’m here to help you understand CVE-2026-69923. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70