Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
A high attack complexity means that successful exploitation is complex and time‑consuming, requiring significant effort and precise conditions for an attacker to reliably exploit the vulnerability.

Do the security updates for CVE-2026-69802 change how Network Device Enrollment Service (NDES) handles certificate requests containing SID information?
Yes. As one of several changes introduced to address this vulnerability, the October 2026 Windows Server security updates cause NDES to reject certificate enrollment requests containing security identifier (SID) information by default, unless a custom NDES policy module is configured. For details about this behavior and configuration guidance for environments where a trusted component validates the SID information, see Configure NDES to handle certificate requests containing SID information.

Security updates
6.2.9200.26434 — https://support.microsoft.com/help/5126835
6.3.9600.23470 — https://support.microsoft.com/help/5126836
10.0.14393.9612 — https://support.microsoft.com/help/5126868
10.0.17763.9376 — https://support.microsoft.com/help/5126651
10.0.20348.5761 — https://support.microsoft.com/help/5126655
10.0.26100.33650 — https://support.microsoft.com/help/5126646