CVE-2026-70235

Awaiting Analysis Awaiting Analysis - Queue

Windows Event Tracing Improper Authentication Spoofing

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Microsoft Corporation

Description

Improper authentication in Windows Event Tracing allows an authorized attacker to perform spoofing locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-70235

EUVD

EUVD-2026-99077

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	Windows	11 Version 24H2 10.0.26100.0
Microsoft	Windows	11 Version 25H2 10.0.26200.0
Microsoft	Windows	11 version 26H1 10.0.28000.0
Microsoft	Windows	11 Version 26H2 10.0.26300.0
Microsoft	Windows	Server 2025 10.0.26100.0
Microsoft	Windows	Server 2025 (Server Core installation) 10.0.26100.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper authentication issue in Windows Event Tracing. An authorized attacker can exploit it to perform spoofing attacks locally on affected systems.

Detection Guidance

Detection requires monitoring for unusual authentication patterns in Windows Event Tracing. Check Event Viewer logs for Event ID 1001 or 1002 under Applications and Services Logs. Use PowerShell commands like Get-WinEvent -LogName 'Microsoft-Windows-Kernel-EventTracing/Admin' to review logs for unauthorized spoofing attempts.

Impact Analysis

An attacker could impersonate legitimate users or processes, potentially gaining unauthorized access to sensitive data or performing actions under false identities.

Compliance Impact

This vulnerability allows local spoofing via improper authentication in Windows Event Tracing. It could potentially enable attackers to manipulate event logs or authentication records, which may impact compliance reporting and audit trails required by standards like GDPR and HIPAA.

Mitigation Strategies

Apply the latest security updates from Microsoft to patch the improper authentication in Windows Event Tracing. Monitor Microsoft's update guide for specific patches related to CVE-2026-70235.

Hi! I’m here to help you understand CVE-2026-70235. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70