Skip to content
Threat Feed
high advisory

Microsoft Windows: Fastprox privilege escalation (CVE-2026-69451)

A public proof-of-concept exploit for CVE-2026-69451 in the Windows Fastprox component enables local privilege escalation via arbitrary command execution.

CVE search metadata

CVE search record: CVE-2026-69451. Severity: high. CVSS: 7.1. EPSS: 0.57%. KEV: no. Product: Windows 10 1607 (< 10.0.14393.9512), Windows 10 1809 (< 10.0.17763.9245), Windows 10 21h2 (< 10.0.19044.7725), Windows 10 22h2 (< 10.0.19045.7725). Brief: Microsoft Windows: Fastprox privilege escalation (CVE-2026-69451). Brief link: https://feed.craftedsignal.io/briefs/2026-10-fastprox-eop/

Triage facts

Revision 1
Applicability
Windows 10 1607 (< 10.0.14393.9512), Windows 10 1809 (< 10.0.17763.9245) +2
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Oct 27, 14:03 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Likely

CVE-2026-69451 is a high-severity vulnerability in the Windows Fastprox component. A proof-of-concept (PoC) tool titled "fastprox_eop.exe" has been published, which allows an attacker with low privileges to execute arbitrary commands on a compromised system. The exploit requires user interaction and is applicable to multiple versions of Windows 10.

Impact

Successful exploitation allows a local attacker with low privileges to escalate their permissions to a higher integrity level, facilitating arbitrary command execution on the target system.

Recommendation

  1. Inventory all Windows 10 endpoints to identify systems running versions earlier than those listed in the affected products section.
  2. Deploy the relevant Microsoft security updates to remediate CVE-2026-69451 on all identified vulnerable systems.
  3. Monitor endpoint telemetry for unauthorized execution of "fastprox_eop.exe" or suspicious command lines involving the Fastprox component.

Immediate actions

Patch vulnerable Windows 10 systems to the versions specified in the affected products list

IT Operations 72h

Threat Hunt

Search for recent executions of processes named fastprox_eop.exe or unusual CLI arguments referencing --cmd and --out

T1068 high high confidence hunt now

Data: Process execution logs (Sysmon EID 1 or EDR equivalent)

Mitigations

Install security patches addressing CVE-2026-69451

immediate IT Operations

CVE-2026-69451

Detection coverage 1

Detect Fastprox EOP Tool Execution

high

Detects the execution of the identified Fastprox EOP PoC tool based on its documented command-line usage.

sigma tactics: privilege_escalation techniques: T1068 sources: process_creation, windows

Detection queries are available on the platform. Get full rules →