CVE-2026-68873Important

Windows Program Compatibility Assistant Service Information Disclosure Vulnerability

Assessment

Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally.

Severity: Important
CVSS base score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Impact: Information Disclosure
EPSS, next 30 days: 0.5%Higher than 38.8% of scored CVEs · FIRST model run 26 Sep 2026 · about EPSS
Exploitability: Exploitation Less Likely
Publicly disclosed: No
Customer action: Required: apply the update
Component: Windows Program Compatibility Assistant Service
Weakness: CWE-532: Insertion of Sensitive Information into Log File
Issued by: Microsoft
Published: 8 Sep 2026 · September 2026
Last revised: 8 Sep 2026

Updates that fix it

4 KBs

KB	Type	Restart	Applies to	Other CVEs
KB5122871	Security Update	Required	Windows Server 2025, Windows Server 2025 (Server Core installation)	All CVEs in KB5122871
KB5122880	Security Update	Required	Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems	All CVEs in KB5122880
KB5124008	Security Update	Required	Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems and 1 more	All CVEs in KB5124008
KB5124012	Security Update	Required	Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems	All CVEs in KB5124012

Affected products

Windows

10 affected products

Windows 11 Version 23H2 for ARM64-based Systems
Windows 11 Version 23H2 for x64-based Systems
Windows 11 Version 24H2 for ARM64-based Systems
Windows 11 Version 24H2 for x64-based Systems
Windows 11 Version 25H2 for ARM64-based Systems
Windows 11 Version 25H2 for x64-based Systems
Windows 11 Version 26H1 for ARM64-based Systems
Windows 11 version 26H1 for x64-based Systems
Windows Server 2025
Windows Server 2025 (Server Core installation)