Microsoft Windows: Fastprox privilege escalation (CVE-2026-69451)
A public proof-of-concept exploit for CVE-2026-69451 in the Windows Fastprox component enables local privilege escalation via arbitrary command execution.
CVE search metadata
CVE search record: CVE-2026-69451. Severity: high. CVSS: 7.1. EPSS: 0.57%. KEV: no. Product: Windows 10 1607 (< 10.0.14393.9512), Windows 10 1809 (< 10.0.17763.9245), Windows 10 21h2 (< 10.0.19044.7725), Windows 10 22h2 (< 10.0.19045.7725). Brief: Microsoft Windows: Fastprox privilege escalation (CVE-2026-69451). Brief link: https://feed.craftedsignal.io/briefs/2026-10-fastprox-eop/
Triage facts
Revision 1- Applicability
- Windows 10 1607 (< 10.0.14393.9512), Windows 10 1809 (< 10.0.17763.9245) +2
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 27, 14:03 UTC
- Detection
- 1 rule
- Vulnerabilities
- 1 CVE
- Source quality
- B2Likely
CVE-2026-69451 is a high-severity vulnerability in the Windows Fastprox component. A proof-of-concept (PoC) tool titled "fastprox_eop.exe" has been published, which allows an attacker with low privileges to execute arbitrary commands on a compromised system. The exploit requires user interaction and is applicable to multiple versions of Windows 10.
Impact
Successful exploitation allows a local attacker with low privileges to escalate their permissions to a higher integrity level, facilitating arbitrary command execution on the target system.
Recommendation
- Inventory all Windows 10 endpoints to identify systems running versions earlier than those listed in the affected products section.
- Deploy the relevant Microsoft security updates to remediate CVE-2026-69451 on all identified vulnerable systems.
- Monitor endpoint telemetry for unauthorized execution of "fastprox_eop.exe" or suspicious command lines involving the Fastprox component.
Immediate actions
Patch vulnerable Windows 10 systems to the versions specified in the affected products list
Threat Hunt
Search for recent executions of processes named fastprox_eop.exe or unusual CLI arguments referencing --cmd and --out
Data: Process execution logs (Sysmon EID 1 or EDR equivalent)
Mitigations
Install security patches addressing CVE-2026-69451
CVE-2026-69451
Detection coverage 1
Detect Fastprox EOP Tool Execution
highDetects the execution of the identified Fastprox EOP PoC tool based on its documented command-line usage.
Detection queries are available on the platform. Get full rules →