CVE-2026-69674: CWE-306: Missing Authentication for Critical Function in Microsoft Windows 10 Version 1809

This vulnerability, identified as CWE-306 (Missing Authentication for Critical Function), affects Windows Modern Device Management (MDM) in Windows 10 Version 1809 and several subsequent builds. It allows an attacker with local authorized access to bypass security features due to missing authentication checks on critical functions. The CVSS 3.1 base score is 5.5, reflecting a medium severity with local attack vector, low attack complexity, and required privileges. The vulnerability impacts integrity but not confidentiality or availability. Microsoft has issued an official fix for the affected versions.

An authorized local attacker can bypass security features in Windows Modern Device Management, potentially compromising system integrity. There is no impact on confidentiality or availability. No known exploits are reported in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69674.