CVE-2026-69329: BranchCache Out-of-Bounds Read DoS Flaw

CVE-2026-69329 Overview

CVE-2026-69329 is an out-of-bounds read vulnerability [CWE-125] in Microsoft BranchCache. An unauthenticated remote attacker can trigger the flaw to cause a denial-of-service condition on affected systems. The vulnerability requires no user interaction and can be exploited across the network with low attack complexity.

Microsoft published the advisory on September 8, 2026. The Exploit Prediction Scoring System (EPSS) currently rates the exploitation probability at 1.056%, placing it in the 62.4 percentile of tracked vulnerabilities.

Critical Impact
Successful exploitation allows unauthenticated attackers to disrupt BranchCache service availability on targeted hosts, degrading content distribution across enterprise WAN links.

Affected Products

Microsoft Windows implementations of BranchCache (refer to the Microsoft Security Response Center advisory for exact build coverage)
Windows Server BranchCache hosted cache servers
Windows client editions with BranchCache distributed cache enabled

Discovery Timeline

2026-09-08 - CVE-2026-69329 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-69329

Vulnerability Analysis

BranchCache is a Windows feature that reduces WAN bandwidth by caching content retrieved from remote servers at branch office locations. The service handles peer discovery and content block exchange over HTTP and Web Services Dynamic Discovery (WS-Discovery) protocols.

The flaw is an out-of-bounds read [CWE-125] within BranchCache message processing. When the service parses a malformed network request, it reads memory outside the intended buffer boundary. This condition causes the BranchCache service to crash and stop delivering cached content.

Because the memory disclosure does not affect confidentiality or integrity, the impact is limited to availability. However, the loss of BranchCache in distributed environments forces every client to fetch content directly from origin servers, saturating WAN links.

Root Cause

The vulnerability stems from insufficient bounds checking during deserialization of attacker-controlled fields in BranchCache protocol messages. The service dereferences a length or offset value from the request without validating that the resulting read stays within the allocated buffer.

Attack Vector

Exploitation occurs remotely over the network. The attacker sends a crafted BranchCache protocol message to a listening host. No authentication or user interaction is required. The malformed request drives the service into an out-of-bounds read that terminates the BranchCache process.

No public proof-of-concept code is available at this time. Refer to the Microsoft Vulnerability Update for CVE-2026-69329 for technical details.

Detection Methods for CVE-2026-69329

Indicators of Compromise

Repeated unexpected termination of the PeerDistSvc (BranchCache) service in the Windows Service Control Manager event log
Windows Error Reporting (WER) crash entries referencing BranchCache modules such as peerdist.dll or PeerDistSvHost.exe
Spikes in inbound traffic to TCP port 80 with BranchCache-specific URIs (/116B50EB-ECE2-41ac-8429-9F9E963361B7/) from untrusted sources

Detection Strategies

Monitor Windows Event Log IDs 7031 and 7034 for PeerDistSvc unexpected stops correlated with inbound network activity
Inspect network telemetry for anomalous BranchCache HTTP requests originating from outside authorized branch subnets
Alert on repeated service crash patterns across multiple hosts within short time windows, which suggest a coordinated denial-of-service attempt

Monitoring Recommendations

Enable verbose logging on BranchCache hosted cache servers and forward events to a centralized SIEM for correlation
Track baseline availability metrics for PeerDistSvc and alert on deviations exceeding normal restart cadence
Review firewall logs for external sources contacting BranchCache ports (TCP 80, TCP 443, UDP 3702 for WS-Discovery)

How to Mitigate CVE-2026-69329

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-69329 as soon as it is validated in test environments
Inventory all hosts with the BranchCache feature installed, including servers and Windows 10/11 clients running distributed cache mode
Restrict inbound access to BranchCache ports so that only authorized branch peers and hosted cache servers can communicate

Patch Information

Microsoft addressed this vulnerability through its September 2026 Update Guide release. Administrators should review the MSRC advisory for the exact KB article, affected build numbers, and deployment guidance. Prioritize patching of hosted cache servers and any internet-exposed hosts running the BranchCache service.

Workarounds

Disable the BranchCache service (PeerDistSvc) on hosts that do not require content caching until the patch is applied
Block inbound traffic to BranchCache ports at the network perimeter and between untrusted network segments
Segment BranchCache peer traffic to trusted branch subnets using Windows Defender Firewall rules or network ACLs

bash

# Temporarily disable BranchCache on Windows hosts pending patch deployment
sc.exe stop PeerDistSvc
sc.exe config PeerDistSvc start= disabled

# Verify service status
sc.exe query PeerDistSvc