PatchTheCVECVE-2026-69802: Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute cod
CVE-2026-69802 is a high-severity flaw (CVSS 8.1) affecting windows server 2012, windows server 2016, windows server 2019. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.
Why this priority
- High severity
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 50%) |
| CISA exploited list | No |
| Weakness | CWE-1390 |
| Published | 2026-10-13 |
| Last modified | 2026-10-27 |
Last updated 2026-10-27 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-69802?
windows server 2012: mitigate or apply the listed mitigation; windows server 2016: upgrade to 10.0.14393.9612; windows server 2019: upgrade to 10.0.17763.9376. Exact commands for each OS are on this page.
Is CVE-2026-69802 being exploited?
CVE-2026-69802 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-69802 affect?
CVE-2026-69802 affects windows server 2012, windows server 2016, windows server 2019. Severity is high (CVSS 8.1). Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.
How urgent is CVE-2026-69802?
Priority 51/100. High severity; Remotely exploitable, no login, no user action; On your watchlist
Software pages
Windows vulnerabilities · Windows Server vulnerabilities
Related CVEs
- CVE-2026-83837 HIGH 7.8 UPGRADE UPGRADE Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges loc
- CVE-2026-26154 HIGH 7.5 MITIGATE UPGRADE Improper input validation in Windows Server Update Service allows an unauthorized attacker to perform tamperin
- CVE-2026-27913 HIGH 7.7 MITIGATE UPGRADE Improper input validation in Windows BitLocker allows an unauthorized attacker to bypass a security feature lo
- CVE-2026-27912 HIGH 8.0 MITIGATE UPGRADE Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacen
- CVE-2026-26183 HIGH 7.8 MITIGATE UPGRADE Improper access control in Windows RPC API allows an authorized attacker to elevate privileges locally.