CVE-2026-72964 in Windows
Summary
by MITRE • 09/09/2026
Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified within the Microsoft Windows Internet Connection Sharing service represents a significant flaw in access control mechanisms, specifically categorized under CWE-306 as Missing Authentication for Critical Function. This defect arises because the ICS component fails to adequately verify the identity or privilege level of the user attempting to modify critical network configuration parameters before executing those changes. In a typical deployment scenario where Internet Connection Sharing is active, this service manages the translation and routing of traffic between different network interfaces, often bridging internal private networks with external public connections through Network Address Translation. The absence of rigorous authentication checks allows any authenticated local user, regardless of their administrative privileges or standard user status, to alter these essential networking settings without proper authorization validation.
From a technical perspective, the operational impact of this vulnerability is substantial for organizations relying on Windows-based systems as network gateways or shared connection points. An attacker with valid credentials on the affected machine can tamper with the underlying configuration that dictates how traffic is routed and translated. This capability enables local privilege escalation in environments where lower-privileged users are expected to have limited control over system networking components. By modifying these settings, an adversary could potentially disrupt network connectivity for other devices relying on this shared connection, create unauthorized routing paths, or facilitate man-in-the-middle attacks by redirecting traffic through malicious endpoints under their control. The ability to tamper with such critical functions undermines the integrity and availability of the local system's networking stack.
This vulnerability aligns closely with MITRE ATT&CK techniques related to Defense Evasion and Persistence, particularly those involving modification of system configurations or network settings to maintain access or obscure activity. Attackers can leverage this flaw to establish a foothold that is difficult to detect through standard monitoring tools focused on process execution rather than configuration state changes. The lack of authentication means there are no audit logs specifically tied to unauthorized attempts to modify these parameters, further complicating incident response and forensic analysis efforts for security operations teams.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Organizations should apply the latest cumulative updates provided by Microsoft that address this specific access control flaw in the Internet Connection Sharing service. Beyond patching, it is advisable to restrict local administrative privileges strictly to essential personnel who require such rights for system maintenance. Implementing strict group policy configurations can also help limit which users are permitted to modify network adapter settings or share internet connections. Additionally, deploying endpoint detection and response solutions that monitor for unauthorized changes to critical registry keys associated with ICS configuration can provide an additional layer of defense against exploitation attempts by detecting anomalous behavior patterns indicative of this specific vulnerability being leveraged.