CVE-2022-26809

What it actually does

CVE-2022-26809 is a critical remote code execution vulnerability in the Microsoft Remote Procedure Call (RPC) runtime. Because RPC is a core Windows component used for interprocess and network service communication, a remote unauthenticated attacker can send specially crafted RPC traffic to a vulnerable Windows system and trigger memory corruption that may allow execution of arbitrary code with the privileges of the targeted RPC service. The CVSS vector indicates network reachability, low attack complexity, no required authentication, no user interaction, and full confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation can allow an attacker to take control of vulnerable Windows workstations or servers without credentials, potentially leading to malware deployment, data theft, lateral movement, domain compromise, service disruption, or ransomware staging. The affected product range is broad, covering many supported and legacy Windows client and server versions, so unpatched exposure can represent significant enterprise-wide risk. Although this CVE is not currently listed in CISA KEV and no ransomware use is indicated in the provided data, the very high CVSS score and high EPSS probability suggest security teams should treat exposed systems as high priority, especially servers reachable over internal or external networks.

How an attack unfolds

An attacker first identifies Windows systems exposing RPC-related services, commonly over TCP port 135 and dynamically assigned RPC ports, and determines whether they are unpatched. The attacker then sends a malformed RPC request designed to reach the vulnerable RPC runtime code path. If exploitation succeeds, the malformed request corrupts memory in a way that permits attacker-controlled code execution in the context of the targeted service. From there, the attacker can run commands, install tooling, create persistence, dump credentials, move laterally using Windows administrative protocols, or deploy disruptive payloads. Because RPC is widely used inside Windows networks, exploitation risk is especially serious where RPC endpoints are reachable from untrusted networks or broad internal segments.

How to fix it

Apply the Microsoft security updates released for CVE-2022-26809 to all affected Windows versions, including Windows 7, Windows 8.1, Windows RT 8.1, Windows 10, Windows 11, Windows Server 2008, Windows Server 2012, Windows Server 2016, Windows Server 2019, and Windows Server 2022 where applicable. For unsupported or end-of-life systems, migrate to supported versions or isolate them behind strict network controls. If immediate patching is not possible, reduce exposure by blocking inbound RPC from untrusted networks, restricting TCP port 135 and dynamic RPC ports to only required management hosts and application dependencies, enforcing host firewalls, segmenting Windows server networks, and disabling unnecessary RPC-accessible services. Do not rely on network filtering alone as a permanent fix; patching remains the primary remediation.

How to confirm the fix worked

Confirm that all affected Windows systems have the relevant Microsoft April 2022 or later cumulative/security updates installed. Validate through centralized patch management, endpoint inventory, vulnerability scanning, and authenticated checks of Windows update history or installed hotfixes. Verify that TCP port 135 and dynamic RPC ports are not exposed to the internet and are restricted internally according to business need. Run authenticated vulnerability scans after patch deployment to confirm the finding is cleared. Where compensating controls are used, test firewall rules from untrusted network segments to ensure RPC endpoint mapper and dynamic RPC communication are blocked except for approved sources.

Typical attack path

1. Scan for Windows hosts exposing RPC endpoint mapper on TCP port 135 and associated dynamic RPC ports.
2. Fingerprint the operating system and patch level to identify potentially vulnerable Windows versions.
3. Send a specially crafted RPC request to the vulnerable RPC runtime interface.
4. Achieve remote code execution in the context of the affected RPC service if the target is vulnerable.
5. Execute post-exploitation commands, deploy payloads, or create persistence.
6. Use obtained access to harvest credentials, move laterally, and compromise additional Windows systems.

How to detect it

To determine whether exploitation has already occurred, review network telemetry for unusual RPC activity, especially inbound connections to TCP port 135 followed by high-numbered dynamic RPC ports from untrusted or unexpected sources. Examine Windows Event Logs for RPC service instability, service crashes, unexpected process creation by service-hosting processes, and signs of post-exploitation. Useful log sources include Windows System logs, Security logs, Sysmon if deployed, EDR telemetry, firewall logs, NetFlow, Zeek/Suricata network metadata, and crash dumps or Windows Error Reporting artifacts. Look for svchost.exe or other RPC-hosted services spawning command shells, scripting engines, payload download utilities, or unknown binaries. Also hunt for follow-on activity such as new service creation, scheduled task creation, credential access, remote logons, SMB-based lateral movement, and abnormal administrative tool execution. Because public, CVE-specific exploit artifacts are not provided in the input, prioritize behavior-based detection over signature-only matching.

• TCP/135 inbound from untrusted source
• ncacn_ip_tcp
• RPC Endpoint Mapper
• svchost.exe spawning cmd.exe
• svchost.exe spawning powershell.exe
• svchost.exe spawning wscript.exe
• svchost.exe spawning cscript.exe
• svchost.exe spawning rundll32.exe
• svchost.exe spawning regsvr32.exe
• Event ID 7031
• Event ID 7034
• Event ID 7045
• Event ID 4688
• Event ID 4698
• Event ID 4624 Logon Type 3
• Event ID 4624 Logon Type 10
• Event ID 4672

What your security team should do

• Prioritize patching Windows servers and workstations that expose RPC services to untrusted networks or broad internal segments.
• Use authenticated vulnerability scanning or endpoint management data to identify all Windows assets missing the Microsoft fix for CVE-2022-26809.
• Restrict inbound access to TCP port 135 and Windows dynamic RPC ports at network and host firewalls.
• Review internet-facing exposure immediately and remove direct RPC access from public networks.
• Increase monitoring for suspicious RPC traffic, service crashes, unexpected child processes from Windows services, and lateral movement activity.
• Segment legacy or unsupported Windows systems that cannot be promptly patched and plan accelerated replacement.
• Hunt for post-exploitation behaviors such as new services, suspicious scheduled tasks, credential dumping tools, and unusual remote administration activity.