CVE-2026-69395

Use of externally-controlled format string in Active Directory Certificate Services (AD CS) allows an authorized attacker to disclose information over a network.

Scoring

Severity

MEDIUM

CVSS base score

6.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

EPSS probability

0.88%

CWE

CWE-134

Published

2026-09-08

Last modified

2026-09-10

Affected products

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Microsoft Windows Server 2012
• Microsoft Windows Server 2012 (Server Core installation)
• Microsoft Windows Server 2012 R2
• Microsoft Windows Server 2012 R2 (Server Core installation)
• Microsoft Windows Server 2016
• Microsoft Windows Server 2016 (Server Core installation)

Weakness type

• CWE-134

Related vulnerabilities

• CVE-2026-16821 — Vulnerabilities in IBM AIX and PowerVM VIOS
• CVE-2026-81574 — Format String Vulnerability in Logger
• CVE-2026-63073 — Untrusted Sender DN Used as Format String in CMP Response Validation
• CVE-2026-17136 — Vulnerabilities in IBM AIX and PowerVM VIOS
• CVE-2026-68553 — Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command
• CVE-2026-15961 — Power System Information Disclosure
• CVE-2026-12004 — Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
• CVE-2026-67244 — A format string vulnerability was found in the Notification OAuth settings of ADM

Markdown version · Browse all CVEs