CVE-2026-69809

Published: Sep 8, 2026Modified: Sep 24, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: secure@microsoft.com (Secondary)

Description

Missing release of memory after effective lifetime in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.

Affected (10)

Products: Microsoft: Windows 11 23h2, Windows 11 24h2, Windows 11 25h2, Windows 11 26h1, Windows Server 2022, Windows Server 2025

6 products

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 11 23h2	version < 10.0.22631.7582
Microsoft Windows 11 23h2	version < 10.0.22631.7582
Microsoft Windows 11 24h2	version < 10.0.26100.9445
Microsoft Windows 11 24h2	version < 10.0.26100.9445
Microsoft Windows 11 25h2	version < 10.0.26200.9445
Microsoft Windows 11 25h2	version < 10.0.26200.9445
Microsoft Windows 11 26h1	version < 10.0.28000.2954
Microsoft Windows 11 26h1	version < 10.0.28000.2954
Microsoft Windows Server 2022	version < 10.0.20348.5622
Microsoft Windows Server 2025	version < 10.0.26100.33438

Related CWEs

CWE-401

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69809

Source: secure@microsoft.com

Vendor AdvisoryPatch

Timeline

No history available yet.