CVE-2026-72964VulnerabilityPublished 09/08/2026Updated 10/14/2026

CVE-2026-72964: CWE-306: Missing Authentication for Critical Function in Microsoft Windows 10 Version 1607

Affects Microsoft Windows 10 Version 1607Source CVE Database V5

CVSS 3.1 base score

5.5Medium

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 0.3% chance of exploitation in 30 days – higher than 21% of CVEs
Patch: Available

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C

What to do

AI-suggested

An official fix is available from Microsoft. Users and administrators should apply the security updates corresponding to their Windows 10 build versions as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72964. No additional mitigation actions are required beyond applying the official patch.

Affected software

Product	Affected	Fixed in
MicrosoftWindows 10 Version 1607	Affected >=10.0.14393.0 <10.0.14393.9512	Fixed in–
MicrosoftWindows 10 Version 1809	Affected >=10.0.17763.0 <10.0.17763.9245	Fixed in–
MicrosoftWindows 10 Version 21H2	Affected >=10.0.19044.0 <10.0.19044.7725	Fixed in–
MicrosoftWindows 10 Version 22H2	Affected >=10.0.19045.0 <10.0.19045.7725	Fixed in–
MicrosoftWindows 11 version 23H2	Affected >=10.0.22631.0 <10.0.22631.7582	Fixed in–
MicrosoftWindows 11 Version 23H2	Affected >=10.0.22631.0 <10.0.22631.7582	Fixed in–
MicrosoftWindows 11 Version 24H2	Affected >=10.0.26100.0 <10.0.26100.9445	Fixed in–
MicrosoftWindows 11 Version 25H2	Affected >=10.0.26200.0 <10.0.26200.9445	Fixed in–
MicrosoftWindows 11 version 26H1	Affected >=10.0.28000.0 <10.0.28000.2954	Fixed in–
MicrosoftWindows Server 2016	Affected >=10.0.14393.0 <10.0.14393.9512	Fixed in–
MicrosoftWindows Server 2016 (Server Core installation)	Affected >=10.0.14393.0 <10.0.14393.9512	Fixed in–
MicrosoftWindows Server 2019	Affected >=10.0.17763.0 <10.0.17763.9245	Fixed in–
MicrosoftWindows Server 2019 (Server Core installation)	Affected >=10.0.17763.0 <10.0.17763.9245	Fixed in–
MicrosoftWindows Server 2022	Affected >=10.0.20348.0 <10.0.20348.5622	Fixed in–
MicrosoftWindows Server 2025	Affected >=10.0.26100.0 <10.0.26100.33438	Fixed in–
MicrosoftWindows Server 2025 (Server Core installation)	Affected >=10.0.26100.0 <10.0.26100.33438	Fixed in–

Description

Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally.

Summary

This vulnerability (CVE-2026-72964) is classified as CWE-306: Missing Authentication for Critical Function. It affects Windows Internet Connection Sharing (ICS) in Windows 10 Version 1607 and later builds. The flaw allows an attacker with local authorized access to perform tampering actions on ICS due to missing authentication checks. The CVSS 3.1 base score is 5.5 (medium), reflecting local attack vector, low attack complexity, required privileges, no user interaction, and impact limited to integrity. Multiple affected Windows 10 versions are identified with specific build ranges. Microsoft has released an official fix to address this issue.

Impact

An authorized local attacker can tamper with Windows Internet Connection Sharing functionality without proper authentication. This could lead to unauthorized modification of ICS settings or behavior, potentially disrupting network connectivity or security configurations. There is no impact on confidentiality or availability reported. No known exploits are currently in the wild.

Weaknesses

CWE-306Missing Authentication for Critical Function (opens in a new tab)

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72964 (opens in a new tab)

What to do

Affected software

Description

AnalysisAI-generated, updated 10/14/2026, 21:50:04 UTC

Technical details

Weaknesses

References

Related threats