Untrusted pointer dereference in Windows Secure Kernel Mode

CVE-2026-83939 is an untrusted pointer dereference in Windows Secure Kernel Mode (securekernel.exe), the VTL1 component that enforces Virtualization-Based Security (VBS), Credential Guard, and HVCI. An attacker who already holds SYSTEM / admin-level privileges on the host can manipulate a pointer that the Secure Kernel trusts without validation, escaping the VTL0→VTL1 boundary. The scope-change flag (S:C) in the CVSS vector reflects this: impact crosses a privilege boundary the normal kernel cannot normally reach. Affected builds span Windows 10.0.28000.0 through 10.0.28000.2953, fixed in 10.0.28000.2954. The flaw was disclosed 2026-09-08 as part of a trio of Secure Kernel EoPs (alongside CVE-2026-69846 and CVE-2026-69906) found by researcher vmpr00be via coordinated MSRC disclosure.

Microsoft rated this HIGH at 8.2, and the rating is broadly fair. The S:C scope change is what prevents a downgrade: this isn't just another kernel LPE to SYSTEM — it's a *post*-SYSTEM escalation that defeats the one isolation layer (VBS/Credential Guard) designed to survive kernel compromise. On a domain controller running Credential Guard, success means extracting cached Kerberos TGTs and NTLM hashes that are supposed to be hypervisor-protected. That said, PR:H (high privileges required) and AV:L (local only) mean an attacker must already own the box at kernel level before this bug becomes relevant, which narrows the real-world urgency compared to a remotely exploitable flaw.

Why this verdict

• Scope change is real and consequential. The S:C flag reflects a genuine VTL0→VTL1 escape. On any host running Credential Guard, this converts a kernel compromise into extraction of hypervisor-protected domain credentials — a qualitative escalation that standard LPE bugs do not provide.
• Role multiplier — domain controllers with Credential Guard. On a DC, VTL1 secrets include cached Kerberos TGTs and NTLM hashes for domain accounts. Extracting these enables golden ticket attacks and domain-wide lateral movement. DCs are a canonical deployment of Credential Guard, meaning the high-value role represents a significant share of the affected component's installed base. Blast radius: host → domain → fleet.
• PR:H caps severity below CRITICAL. The attacker must already hold SYSTEM-level privileges locally. This is a deep post-exploitation capability, not an initial-access vector. The bug extends an existing compromise rather than enabling a new one, which limits urgency relative to remotely exploitable flaws.
• No PoC, no exploitation, low EPSS. With EPSS at 0.3%, no public exploit code, and no KEV listing, the near-term weaponization risk is low. However, the announced researcher blog will likely change this calculus — Secure Kernel exploit primitives attract APT-grade interest.

Why not higher?

A CRITICAL rating would require either active exploitation or a lower prerequisite bar. The PR:H requirement means the attacker must already own the kernel — this is not an initial-access or low-privilege escalation vector. Without a public PoC and with zero in-the-wild activity, the immediacy does not justify CRITICAL. If the researcher releases working exploit code and Credential Guard bypass is demonstrated on DCs, reassessment toward CRITICAL would be warranted.

Why not lower?

The VBS boundary escape is not cosmetic — it defeats the *last line of defense* that Credential Guard provides against kernel-level attackers. On domain controllers and high-security endpoints, this is the difference between 'compromised one host' and 'extracted domain-wide secrets that VBS was specifically designed to protect.' The floor for a vulnerability in the Secure Kernel (a hypervisor-tier component by definition) with demonstrated scope change is HIGH.

1. Prioritize patching on DCs and Credential Guard-enabled servers first — These are the hosts where VTL1 escape translates to domain-credential extraction. Apply the September 2026 cumulative update (build 10.0.28000.2954+) to all domain controllers and Tier-0 assets within the noisgate HIGH remediation SLA of 180 days, but front-load DCs to within 30 days.
2. Audit and restrict local admin / SYSTEM access paths — Since PR:H is the gating prerequisite, reducing the population of accounts and processes that can reach SYSTEM on high-value hosts directly limits exploitability. Review LAPS coverage, remove standing admin rights, enforce just-in-time (JIT) admin via PAM. Deploy within 30 days per noisgate mitigation SLA.
3. Monitor Credential Guard health events — Windows Event IDs 6400–6499 report Credential Guard operational status. Alert on unexpected Credential Guard failures or policy changes, which could indicate VTL1 tampering. Configure SIEM collection within 30 days.
4. Enable HVCI alongside Credential Guard — While this CVE can theoretically bypass HVCI via VTL1 write, co-enabling HVCI raises the bar for the VTL0 exploit primitives needed to trigger the pointer dereference. It doesn't block the bug but adds friction to the chain.
5. Watch for vmpr00be PoC release and re-triage — The researcher has announced a forthcoming technical blog with exploit code. When it drops, reassess urgency — a working PoC for Credential Guard bypass will attract rapid APT adoption. Set a monitoring alert for the researcher's publications.

Run on each target Windows host with administrator privileges. Example: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-83939.ps1. The script checks whether the installed OS build is in the affected range and whether VBS/Credential Guard is active (which determines real-world exposure).

#Requires -RunAsAdministrator
# Check-CVE-2026-83939.ps1
# Checks for CVE-2026-83939: Untrusted pointer dereference in Windows Secure Kernel Mode
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

try {
    $build = [System.Environment]::OSVersion.Version
    $fullBuild = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name UBR -ErrorAction SilentlyContinue).UBR
    $buildStr = "$($build.Major).$($build.Minor).$($build.Build).$fullBuild"
    Write-Host "[*] OS Build: $buildStr"

    # Check if this is the affected build family (28000.x)
    if ($build.Build -ne 28000) {
        Write-Host "[*] Build family $($build.Build) is outside the known affected range (28000)."
        Write-Host "UNKNOWN"
        exit 2
    }

    # Affected: 28000.0 through 28000.2953, fixed at 28000.2954+
    if ($null -eq $fullBuild) {
        Write-Host "[!] Could not determine UBR (Update Build Revision)."
        Write-Host "UNKNOWN"
        exit 2
    }

    # Check VBS / Credential Guard status for exposure context
    $dg = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace 'root\Microsoft\Windows\DeviceGuard' -ErrorAction SilentlyContinue
    $vbsRunning = ($dg.VirtualizationBasedSecurityStatus -eq 2)
    $credGuard = ($dg.SecurityServicesRunning -contains 1)
    Write-Host "[*] VBS Running: $vbsRunning | Credential Guard Active: $credGuard"

    if ($fullBuild -le 2953) {
        Write-Host "[!] Build $buildStr is in the AFFECTED range (fixed in 28000.2954)."
        if ($vbsRunning) {
            Write-Host "[!] VBS is ACTIVE - this host is exploitable if an attacker achieves SYSTEM."
        } else {
            Write-Host "[*] VBS is NOT active - vulnerability exists but practical impact is reduced."
        }
        Write-Host "VULNERABLE"
        exit 1
    } else {
        Write-Host "[+] Build $buildStr is at or above the fix (28000.2954)."
        Write-Host "PATCHED"
        exit 0
    }
} catch {
    Write-Host "[!] Error during check: $_"
    Write-Host "UNKNOWN"
    exit 2
}

Sources

1. BrinzTech — Three Elevation of Privilege Vulnerabilities in Windows Secure Kernel
2. THREATINT CVE-2026-83939 Entry
3. CrowdStrike — September 2026 Patch Tuesday Analysis
4. Qualys — Microsoft Patch Tuesday September 2026 Review
5. Cyber Security News — September 2026 Patch Tuesday (973 CVEs)
6. ParagMali — Windows Secure Kernel Architecture Deep Dive
7. Talos — Microsoft Patch Tuesday September 2026