CVE-2026-69534

Improper neutralization of special elements used in a command ('command injection') in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

Scoring

Severity

HIGH

CVSS base score

7.8

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE

CWE-77

Published

2026-09-08

Last modified

2026-09-09

Affected products

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• Microsoft Windows 10 Version 22H2
• Microsoft Windows 11 version 23H2
• Microsoft Windows 11 Version 23H2
• Microsoft Windows 11 Version 24H2
• Microsoft Windows 11 Version 25H2

Weakness type

• CWE-77

Related vulnerabilities

• CVE-2026-83948 — Microsoft Azure CLI Remote Code Execution Vulnerability
• CVE-2026-81380 — GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
• CVE-2026-84387 — A improper neutralization of special elements used in a command ('command injection') vulnerability...
• CVE-2026-86427 — LibreNMS before 26.8.0 Argument Injection via graph_title
• CVE-2026-86299 — Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection
• CVE-2026-86295 — D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection
• CVE-2026-79698 — Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection
• CVE-2026-79697 — Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection

Markdown version · Browse all CVEs