Insufficient Granularity of Access Control in Microsoft Windows and Windows Server - CVE-2026-122169

Vulnerability details

The vulnerability allows a local user to impersonate the desktop user's authenticated network identity outside an AppContainer sandbox.

The vulnerability exists due to insufficient granularity of access control in Windows IKE Extension when handling authenticated network access from an AppContainer application. A local user can use an application running in an AppContainer to access a target service using the desktop user's authenticated network identity outside the sandbox. This does not by itself grant code execution or bypass additional authorization required by the target service.

Exploitation requires connection-security policies applicable to the target service and an existing authenticated connection established by a desktop application for the same user. The vulnerability alone cannot establish that desktop connection.

Affected software

How to mitigate CVE-2026-122169

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-122169
• https://support.microsoft.com/help/5131291

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows