CVE-2026-35420

What it actually does

This vulnerability is a heap-based buffer overflow in the Windows Kernel that can allow a local, authenticated attacker to corrupt kernel memory and execute code with elevated privileges. Because the flaw is in kernel-mode code, successful exploitation can allow escalation from a low-privileged local account to SYSTEM-level privileges, enabling full control of the affected Windows Server host. The CVSS vector indicates local access is required, attack complexity is low, user interaction is not required, and successful exploitation can fully compromise confidentiality, integrity, and availability on the impacted system.

Why it matters to the business

If exploited, this flaw can turn an ordinary compromised user account or foothold on a Windows Server into complete administrative control of that server. This may allow attackers to disable security tools, steal sensitive data, tamper with applications, deploy malware, or use the server to move deeper into the network. The current EPSS score is low and stable, the issue is not listed in CISA KEV, and no public exploit maturity is reported, but kernel privilege-escalation vulnerabilities are high-value post-compromise tools and should still be prioritized on internet-facing, domain-joined, high-value, or multi-user Windows Server systems.

How an attack unfolds

An attacker must first obtain local authenticated access to an affected Windows Server system, such as through stolen credentials, exploitation of another service, malware execution, or access to a low-privileged account. The attacker then runs a specially crafted local program that interacts with the vulnerable Windows Kernel component and triggers a heap-based buffer overflow. By carefully shaping heap memory and controlling the overflowed data, the attacker attempts to overwrite kernel memory structures or control flow in a way that causes code to run in kernel context. If successful, the attacker elevates privileges to SYSTEM, after which they can create or modify privileged accounts, dump credentials, disable endpoint protection, install persistence, tamper with logs, deploy additional payloads, or pivot to other systems. There are no named threat actors, CISA KEV listing, ransomware linkage, or public exploit maturity reported in the provided intelligence, so current exploitation likelihood appears limited; however, exploitation would be severe where an attacker already has a foothold.

How to fix it

Apply the relevant Microsoft security updates for the affected Windows Server versions as soon as they are available through Windows Update, Microsoft Update Catalog, WSUS, Microsoft Configuration Manager, or other enterprise patch management tooling. No exact fixed build or package versions were provided, so administrators should verify against Microsoft’s official security update guidance for CVE-2026-35420 and confirm the host is running a patched monthly cumulative update for its supported Windows Server release. Prioritize Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025 systems that are domain controllers, virtualization hosts, jump servers, remote access infrastructure, application servers, or systems used by multiple administrators or users. Where immediate patching is not possible, reduce exposure by limiting local logon rights, enforcing least privilege, restricting interactive/RDP access, preventing untrusted executable execution with application control, enabling endpoint detection and response, and monitoring for local privilege-escalation behavior. Because this is a local kernel vulnerability, network perimeter filtering alone is not an effective mitigation.

How to confirm the fix worked

Confirm that affected Windows Server systems have installed the Microsoft cumulative security update that remediates this vulnerability. Validate patch deployment through Windows Update history, installed hotfix inventory, enterprise patch-management reports, or PowerShell-based build and hotfix checks. Compare OS build numbers and installed cumulative updates against Microsoft’s official release notes for the relevant Windows Server version. After patching, reboot systems where required and verify the update remains installed after restart. Also validate that local privilege controls are enforced: non-administrative users should not have unnecessary interactive logon rights, untrusted binaries should be blocked where possible, and endpoint telemetry should be active. If using vulnerability management tooling, rescan representative patched systems to confirm the vulnerability is no longer reported.

Typical attack path

1. Gain local authenticated access to an affected Windows Server system using valid credentials, malware, or a separate vulnerability.
2. Transfer or stage a local privilege-escalation executable, script, or exploit component on the server.
3. Execute code that triggers the vulnerable Windows Kernel heap-based buffer overflow.
4. Manipulate kernel heap state to corrupt memory and redirect execution or modify privileged kernel objects.
5. Obtain SYSTEM-level privileges on the host.
6. Disable defenses, dump credentials, create persistence, access sensitive data, or move laterally to additional systems.

How to detect it

To determine whether this vulnerability may already have been exploited, focus on post-exploitation evidence because a kernel heap overflow may not leave a unique application-layer log entry. Review Windows Security, System, PowerShell, Sysmon, EDR, and application control logs for suspicious local privilege-escalation patterns: a low-privileged user session followed by SYSTEM-level process execution, unexpected service creation, scheduled task creation, driver loading, security control tampering, credential dumping, or new administrative accounts. In Windows Security logs, look for process creation events if enabled, privileged logons, special privilege assignment, new service installation, local group membership changes, and account creation. In Sysmon, look for suspicious process ancestry where a user-writable path launches a binary that rapidly spawns SYSTEM processes, loads unusual drivers, or modifies sensitive system locations. Review System logs for kernel crashes, bugchecks, unexpected reboots, or driver load failures around suspicious user activity, as failed exploitation attempts against kernel memory may cause instability. Since no specific public exploit, malware family, file name, or threat actor behavior was provided, detection should rely on behavioral correlation rather than a single signature.

• Windows Security Event ID 4672 - Special privileges assigned to new logon
• Windows Security Event ID 4688 - A new process has been created
• Windows Security Event ID 4697 - A service was installed in the system
• Windows Security Event ID 4720 - A user account was created
• Windows Security Event ID 4732 - A member was added to a security-enabled local group
• Windows Security Event ID 7045 - A new service was installed in the system
• Windows System Event ID 1001 - BugCheck
• Windows System Event ID 6008 - The previous system shutdown was unexpected
• Sysmon Event ID 1 - Process Create
• Sysmon Event ID 6 - Driver Loaded
• Sysmon Event ID 11 - FileCreate
• Sysmon Event ID 12 - Registry object created or deleted
• Sysmon Event ID 13 - Registry value set
• C:\Windows\Temp\*.exe
• C:\Users\Public\*.exe
• C:\ProgramData\*.exe
• C:\Windows\System32\drivers\*.sys
• HKLM\SYSTEM\CurrentControlSet\Services\

What your security team should do

• Inventory all affected Windows Server versions, including Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025, and identify high-value or broadly accessible systems first.
• Track Microsoft’s official advisory and deploy the applicable cumulative security updates through standard patch management channels.
• Prioritize patching of domain controllers, remote access servers, jump boxes, virtualization hosts, file servers, application servers, and systems where many users or administrators can log on interactively.
• Review and restrict local logon, RDP, service account, and scheduled task permissions to reduce the number of principals able to exploit a local privilege-escalation flaw.
• Use application control, attack surface reduction rules, and EDR policy to block execution of unknown or unsigned local exploit binaries.
• Hunt for signs of local privilege escalation, especially low-privileged user activity followed by SYSTEM-level process creation, security tool tampering, credential dumping, or suspicious account creation.
• Monitor exploit intelligence for changes in exploit maturity, EPSS movement, CISA KEV listing, or threat actor adoption, and accelerate response if public exploitation emerges.