VulnSocial

CVE-2026-69379Disclosure(microsoft / windows_11_23h2)

LOWCVSS 7.0 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to elevate privileges locally.

microsoft CVEsBack to dashboard
2.0/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-59

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • windows_11_23h2
  • windows_11_24h2
  • windows_11_25h2
  • windows_11_26h1

Threat summary

  • Public PoC is present in monitored signal
  • 1 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
microsoft
Products
windows_11_23h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2025

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-13: 1PoC Mentioned / Linked · 2026-09-13: 1Technical Details · 2026-09-13: 109-13
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • UNDERCODE TESTING@UndercodeUpdate
    Disclosure

    🚨 #CVE-2026-69379: TOCTOU in ReFsDedupSvc Enables Arbitrary File Overwrite as SYSTEM + Video -Prediction: 📈 3 Positive | 📉 2 Negative https://undercodetesting.com/cve-2026-69379-toctou-in-refsdedupsvc-enables-arbitrary-file-overwrite-as-system-video/ Educational Purposes!

    Post summary

    The tweet announces CVE-2026-69379, describing a TOCTOU flaw in ReFsDedupSvc that enables arbitrary file overwrite as SYSTEM and provides a link for further details.

    0000056
    739 followersView on X
CPE platform detail9 entries

9 of 9 entries

PartVendorProductVersionTarget SWTarget HW
OSmicrosoftwindows_11_23h2--arm64
OSmicrosoftwindows_11_23h2--x64
OSmicrosoftwindows_11_24h2--arm64
OSmicrosoftwindows_11_24h2--x64
OSmicrosoftwindows_11_25h2--arm64
OSmicrosoftwindows_11_25h2--x64
OSmicrosoftwindows_11_26h1--arm64
OSmicrosoftwindows_11_26h1--x64
OSmicrosoftwindows_server_2025---

Explore more

Back to dashboardmicrosoft CVEswindows_11_23h2 vulnerabilities