Local Privilege Escalation in Windows ipt.sys Driver (CVE‑2026‑65773)
What It Is — A newly disclosed vulnerability (CVE‑2026‑65773) in the Windows ipt.sys network driver allows a local attacker to elevate privileges to SYSTEM by exploiting an incorrectly set registry key permission. The flaw is confined to the driver’s registry entry and requires the attacker to already have low‑privilege code execution on the host.
Exploitability — CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been released, but the vulnerability is trivial to weaponize once low‑privilege code is present.
Affected Products — Microsoft Windows (all supported editions that include the ipt.sys driver).
Why It Matters for Compliance & Audit Readiness
- SOC 2 Access Controls – Mis‑configured permissions violate the Least Privilege and System Operations criteria (CC6.1, CC6.2). Demonstrating remediation shows you’re meeting those controls.
- Change‑Management Evidence – Applying Microsoft’s patch and documenting the registry‑permission fix provides concrete audit artifacts for the Change Management control (CC7.1).
- Continuous Monitoring – Ongoing verification that critical registry keys retain proper ACLs is essential for a defensible SOC 2 audit and for reassuring enterprise customers that privilege‑escalation risks are actively managed.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2026‑65773 immediately.
- Audit the
HKLM\SYSTEM\CurrentControlSet\Services\iptregistry key permissions; enforce “SYSTEM”‑only write access. - Integrate registry‑ACL checks into your continuous compliance monitoring platform.
- Update your privileged‑access policy to reflect the corrected permissions and train administrators on least‑privilege principles.
- Capture patch‑deployment logs and ACL‑audit reports as evidence for SOC 2 auditors.
Source: Zero Day Initiative advisory