Microsoft acknowledged my report of a Windows vulnerability allowing a local authenticated attacker to modify protected system data. Microsoft published CVE-2026-69321 on September 8, 2026.
| Field | Public advisory details |
|---|---|
| CVE | CVE-2026-69321 |
| Microsoft title | Windows Power Dependency Coordinator Tampering Vulnerability |
| Impact | Tampering |
| Microsoft severity | Important |
| CVSS 3.1 base score | 5.5 |
| CVSS base vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| Weakness | CWE-306: Missing Authentication for Critical Function |
| Published | September 8, 2026 |
| Acknowledgements | Steven Foerster and Prayas (Pro bear) |
The public record
Microsoft describes missing authentication for a critical function in Windows Power Dependency Coordinator. An authenticated local attacker can make unauthorized modifications to protected system data, potentially altering system state or configuration beyond their normal privileges. The advisory states that the attack does not require administrator privileges or user interaction.
Microsoft credits Steven Foerster and Prayas (Pro bear) in the advisory’s acknowledgements.
Read Microsoft’s advisory and researcher acknowledgement. The advisory is the authoritative source for affected products, available security updates, and Microsoft’s current assessment.
Technical analysis to follow
I plan to expand this same page with technical analysis after a 30-day patch-adoption window and post-fix validation. Microsoft released the security update on September 8, 2026, so that window ends on October 8, 2026.
About the researcher
I am Steven Foerster, a security architect, engineering leader, and Microsoft Security Response Center bug bounty recipient. I research authorization and trust-boundary failures in privileged software.
Read my public security research, learn more about my background, or get in touch.