CVE-2026-69554: CWE-306: Missing Authentication for Critical Function in Microsoft Windows 10 Version 1607

This vulnerability, identified as CWE-306 (Missing Authentication for Critical Function), affects multiple versions of Microsoft Windows 10 including Version 1607 and later builds up to specific patched versions. It involves the Windows Search Component lacking proper authentication for a critical function, enabling an authorized local attacker to perform tampering. The CVSS 3.1 vector indicates the attack requires local access with low complexity and privileges, no user interaction, and impacts integrity but not confidentiality or availability. Microsoft has released an official fix addressing this issue.

An authorized local attacker can exploit this vulnerability to tamper with critical functions in the Windows Search Component, potentially altering system behavior or data integrity. There is no impact on confidentiality or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69554.