CVE-2026-72964: Windows ICS Auth Bypass Vulnerability

CVE-2026-72964 Overview

CVE-2026-72964 is a missing authentication vulnerability in the Windows Internet Connection Sharing (ICS) service. The flaw allows an authorized local attacker to perform tampering operations against a critical function that fails to enforce authentication checks. Microsoft published the advisory through the MSRC Update Guide.

The issue is tracked under CWE-306: Missing Authentication for Critical Function. Exploitation requires local access and low privileges, and impacts the integrity of the affected system without directly compromising confidentiality or availability.

Critical Impact
An authenticated local user can tamper with data or configuration managed by the ICS service, potentially altering shared network state on the host.

Affected Products

Microsoft Windows (Internet Connection Sharing component)
Refer to the Microsoft CVE-2026-72964 Update Guide for the full list of supported Windows versions and builds

Discovery Timeline

2026-09-08 - CVE-2026-72964 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72964

Vulnerability Analysis

The vulnerability resides in the Windows Internet Connection Sharing (ICS) service, which enables a Windows host to share its internet connection with other devices on a local network. ICS exposes management and configuration functions to local processes. One or more of these functions omit an authentication check before performing security-relevant operations.

An attacker with local, low-privileged access can invoke the affected function and modify state that should require higher privilege or an explicit trust check. Because the impact is limited to integrity, the attacker cannot directly read protected data or crash the host, but can tamper with the shared networking configuration and related settings.

Root Cause

The root cause is classified as CWE-306: Missing Authentication for Critical Function. A code path within ICS performs a privileged action without validating the caller's identity or authorization. This design gap turns a routine local interface into a tampering primitive for any authenticated user on the machine.

Attack Vector

Exploitation is local. The attacker must already hold a valid session on the target Windows host with low privileges and no user interaction from another account. From that context, the attacker interacts with the exposed ICS function through its local interface and issues requests that alter protected configuration. No public proof-of-concept code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft CVE-2026-72964 Update Guide for vendor-provided technical detail.

Detection Methods for CVE-2026-72964

Indicators of Compromise

Unexpected changes to Internet Connection Sharing configuration, including newly enabled ICS instances or altered shared adapter bindings
Local process activity from non-administrative users interacting with ICS-related services such as SharedAccess or hnetcfg.dll
Registry modifications under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess originating from unprivileged user contexts

Detection Strategies

Monitor Windows Service Control Manager events for start, stop, and configuration changes on the SharedAccess service
Alert on non-administrative accounts invoking APIs or COM interfaces associated with HNetCfg or ICS management
Correlate local logon events with subsequent modifications to network sharing configuration on the same host

Monitoring Recommendations

Enable auditing for registry keys and service configuration paths tied to ICS, and forward the events to a centralized log platform
Track baseline ICS state across the fleet and flag hosts where ICS becomes enabled outside of change control
Review process command lines and parent-child relationships for svchost.exe instances hosting SharedAccess

How to Mitigate CVE-2026-72964

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-72964 to all affected Windows systems
Inventory endpoints and servers where the Internet Connection Sharing service is running or set to start automatically
Restrict interactive and remote local logon rights to trusted administrative accounts on hosts that require ICS

Patch Information

Microsoft addresses CVE-2026-72964 through its Update Guide. Administrators should consult the Microsoft CVE-2026-72964 Update Guide to identify the applicable KB article and cumulative update for each supported Windows release, then deploy through Windows Update, WSUS, Microsoft Intune, or an equivalent patch management pipeline.

Workarounds

Disable the Internet Connection Sharing service (SharedAccess) on systems that do not require connection sharing, and set the startup type to Disabled
Enforce least privilege so that only administrative users can log on locally to hosts where ICS must remain enabled
Segment shared-network hosts from sensitive assets to limit the blast radius of local tampering

bash

# Configuration example: disable the ICS service on hosts that do not require it
sc.exe config SharedAccess start= disabled
sc.exe stop SharedAccess