CVE-2026-35422

What it actually does

This vulnerability is an authentication bypass in the Windows TCP/IP stack caused by use of an alternate path or channel that can bypass an intended security control. A network-adjacent or network-reachable attacker who already has some authorized level of access can send crafted network traffic to an affected Windows client or server and cause the TCP/IP component to treat the traffic as satisfying a security condition it should not satisfy. The CVSS vector indicates low attack complexity, no user interaction, low privileges required, and high integrity impact, meaning the primary technical risk is unauthorized modification, spoofing, policy bypass, or trust-boundary violation rather than direct data disclosure or denial of service.

Why it matters to the business

Successful exploitation could allow a low-privileged authenticated attacker to bypass a network security feature on affected Windows workstations or servers, potentially enabling unauthorized changes, lateral movement support, or compromise of systems that rely on Windows networking controls for enforcement. The issue affects many supported Windows desktop and server versions, including Windows 10, Windows 11, Windows Server 2012 through 2025, so enterprise exposure may be broad. It is not listed in CISA KEV, is not identified as ransomware-used, has low and flat EPSS activity, and has no reported exploit maturity in the provided data, so remediation should be prioritized through normal patch governance unless affected systems sit in sensitive network segments or enforce critical access boundaries.

How an attack unfolds

An attacker first obtains a valid low-privileged foothold or otherwise meets the prerequisite of being an authorized network participant. From a reachable network position, the attacker targets an affected Windows system and sends specially formed traffic through an alternate TCP/IP path or channel that is not correctly subject to the expected authentication or security-feature enforcement. If the vulnerable code path is reached, Windows TCP/IP may accept or process the traffic in a way that bypasses the intended security feature, allowing the attacker to influence system or network state with higher integrity impact than their authorization should permit. There is no public exploit maturity or known campaign information in the provided data, so exploitation details and artifacts should be treated as product-specific and may vary by deployment configuration.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-35422 for every affected Windows release, including Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2012/2016/2019/2022/2022 23H2, and Windows Server 2025. Because no exact fixed build numbers were provided, use Microsoft Update, Windows Update for Business, WSUS, Microsoft Configuration Manager, or the Microsoft Update Catalog to deploy the relevant cumulative update released for this issue on or after the May 2026 security release. Prioritize domain controllers, VPN concentrator-adjacent servers, jump hosts, management servers, exposed Windows servers, and systems that enforce segmentation or network access policy. Where immediate patching is not possible, reduce exposure by restricting inbound access to trusted networks, enforcing host firewalls, limiting lateral network reachability, requiring strong network authentication, disabling unnecessary services, and monitoring authenticated network traffic anomalies.

How to confirm the fix worked

Confirm that affected Windows assets have installed the cumulative security update containing the fix by checking Windows Update history, WSUS/SCCM compliance, Microsoft Defender Vulnerability Management, or equivalent endpoint inventory. Validate OS build and patch level against Microsoft’s security update guidance for the relevant Windows release. From a network perspective, verify that host firewalls, segmentation rules, and access control lists limit inbound connectivity to only required sources. For high-value systems, perform authenticated vulnerability scanning after patch deployment and confirm the scanner no longer reports exposure to this issue. If compensating controls are used, test that untrusted or low-privileged network locations cannot reach the affected TCP/IP attack surface except through approved paths.

Typical attack path

1. Gain low-privileged authorized access to a network, domain, application, or host that can reach an affected Windows system.
2. Identify reachable Windows clients or servers running affected versions of Windows TCP/IP.
3. Probe network services, routing paths, or security-feature boundaries to determine whether the target exposes the vulnerable TCP/IP behavior.
4. Send crafted network traffic that uses the alternate path or channel required to bypass the intended security check.
5. Abuse the bypass to alter trusted network behavior, weaken enforcement, or support follow-on activity such as lateral movement or unauthorized changes.
6. Blend the activity into normal authenticated network traffic to reduce detection likelihood.

How to detect it

There are no specific public exploit indicators, threat actor associations, or known ransomware use in the provided data, so detection should focus on behavioral evidence rather than fixed signatures. Review Windows Security logs, Windows Filtering Platform events, firewall logs, VPN/NAC logs, EDR network telemetry, NetFlow, DNS, DHCP, and authentication logs for low-privileged accounts or unexpected hosts initiating unusual connections to Windows systems before patching. Look for network traffic that bypasses expected segmentation or access-control paths, repeated probing of Windows hosts from authenticated but unusual sources, unexpected changes in firewall/IPsec/NLA-related behavior, and lateral movement attempts following suspicious TCP/IP activity. Correlate anomalies with account privilege level, source device posture, failed and successful authentication events, new remote sessions, administrative share access, service creation, scheduled task creation, and remote management activity. Because no reliable CVE-specific payload strings are available, any alerting should be tuned around deviations from normal Windows network access patterns and post-bypass follow-on actions.

What your security team should do

• Inventory all affected Windows desktop and server versions and map them to business-critical roles and network exposure.
• Deploy the relevant Microsoft cumulative security updates through standard patch channels, prioritizing internet-facing, management, identity, and segmentation-sensitive Windows systems.
• Because exploitation requires low privileges but no user interaction and has high integrity impact, treat unpatched high-value servers as elevated priority even though EPSS is currently low and the issue is not in KEV.
• Use network segmentation and host firewall policy to restrict access to Windows systems that cannot be patched immediately.
• Review recent authenticated network activity for unusual source/destination pairs, unexpected protocol use, or changes to network security enforcement behavior.
• Ensure vulnerability scanners and endpoint management tools are updated with checks for the May 2026 Windows security release covering this issue.
• Track Microsoft advisories for revised fixed build numbers, exploitability assessment changes, or newly disclosed exploitation details.