CVE-2026-40399

What it actually does

This is a local privilege escalation vulnerability in the Windows TCP/IP implementation caused by improper synchronization of shared resources during concurrent execution. An attacker who already has valid local code execution with low privileges can trigger a race condition in the networking stack and potentially cause unsafe kernel-state changes, allowing execution with elevated privileges such as SYSTEM. Successful exploitation can provide high-impact confidentiality, integrity, and availability consequences because the flaw crosses from a normal user context into privileged Windows kernel or system-level control. It is not a remote unauthenticated entry point; the attacker must already be able to run code locally on the affected Windows system.

Why it matters to the business

If exploited after an initial compromise, this flaw can let an attacker turn limited access into full control of Windows workstations or servers, enabling credential theft, security tool tampering, lateral movement, data theft, or deployment of destructive payloads. The affected product set is broad, covering many supported Windows 10, Windows 11, and Windows Server releases, so enterprise exposure may be widespread. Current public risk signals are lower than for actively exploited vulnerabilities: EPSS is low and flat at approximately 0.0033 over 30 days, there is no known CISA KEV listing, no known ransomware association, and no reported mature public exploit in the provided data. Even so, because successful exploitation yields high privilege, organizations should include it in regular Windows patch cycles and prioritize systems that are internet-facing, shared by multiple users, used for administration, or host sensitive workloads.

How an attack unfolds

An attacker first obtains a foothold that allows them to execute code as a normal authenticated user on an affected Windows system, such as through phishing, stolen credentials, abuse of a legitimate remote access path, or exploitation of a separate vulnerability. The attacker then runs a local exploit that repeatedly exercises vulnerable TCP/IP code paths in a way that creates competing operations against a shared kernel resource. If the timing is successful, the race condition causes the Windows networking stack to enter an unsafe state that can be abused to elevate the attacker’s privileges. The attacker then uses the elevated context to disable defenses, dump credentials, install persistence, access protected files, create privileged accounts, move laterally, or execute additional payloads. There are no named threat actors, known ransomware campaigns, or mature public exploits identified in the provided intelligence, but this class of vulnerability is commonly valuable as a post-compromise privilege escalation step.

How to fix it

Apply the Microsoft security update that remediates CVE-2026-40399 for each affected Windows release. Because no exact fixed package or KB versions were provided, use the official Microsoft Security Update Guide for this CVE and install the applicable cumulative update for Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025 systems. Prioritize shared workstations, jump servers, domain administration systems, virtualization hosts, remote desktop servers, and servers running sensitive workloads. If immediate patching is not possible, reduce risk by limiting interactive logon rights, restricting local code execution, enforcing application control, removing unnecessary local administrator rights, hardening remote access paths, monitoring for privilege escalation behavior, and ensuring endpoint protection and EDR are active. Because this is a local privilege escalation issue in the Windows networking stack, network perimeter filtering alone should not be considered a complete mitigation.

How to confirm the fix worked

Confirm exposure by inventorying Windows endpoints and servers against the affected product list: Windows 10 1607, 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H1; Windows Server 2016, 2019, 2022, 2022 23H2, and 2025. Validate remediation by confirming the applicable Microsoft cumulative update for this CVE is installed using enterprise patch tooling, Microsoft Defender Vulnerability Management, Windows Update for Business, WSUS, Configuration Manager, or local commands such as Get-HotFix, systeminfo, or Windows Update history. Where available, verify the reported OS build and servicing baseline match Microsoft’s fixed guidance. Run authenticated vulnerability scans after patch deployment and confirm the scanner no longer reports the CVE. For high-value systems, also confirm there are no pending reboots, failed update installations, or devices excluded from normal servicing rings.

Typical attack path

1. Gain authenticated local code execution on an affected Windows workstation or server.
2. Confirm the operating system build is within the vulnerable Windows 10, Windows 11, or Windows Server product range.
3. Run a local privilege escalation tool that triggers concurrent TCP/IP operations against the vulnerable synchronization logic.
4. Win the race condition and obtain elevated execution, typically SYSTEM or an equivalent high-privilege context.
5. Use elevated access to alter security controls, access protected data, dump credentials, create persistence, or move laterally.
6. Cover tracks by removing tooling, clearing temporary files, or blending activity into normal administrative processes.

How to detect it

There may be no reliable single log entry that proves exploitation of this race condition because successful abuse occurs inside local Windows TCP/IP kernel behavior. Detection should therefore focus on suspicious local privilege escalation and follow-on activity. Review Windows Security logs for process creation, privilege assignment, new service creation, scheduled task creation, unusual logon activity, and administrative group changes. Useful event IDs include 4688 for process creation, 4672 for special privileges assigned, 4624 and 4648 for logons using explicit credentials, 4697 or System 7045 for service installation, 4698 and TaskScheduler Operational 106 for scheduled task creation, 4732 and 4728 for group membership changes, and 1102 for audit log clearing. If Sysmon is deployed, review Event ID 1 for process creation, 7 for image loads, 10 for sensitive process access, 11 for file creation, and 13 for registry changes. Look for a low-integrity or standard-user process rapidly followed by SYSTEM-level child processes, command shells, PowerShell, credential dumping tools, new services, or security tooling being stopped. Review EDR telemetry for token manipulation, unexpected privilege changes, kernel exploit detections, unsigned or newly written executables in user-writable paths, and abnormal interaction with networking APIs immediately before privilege escalation. Check Windows System and Reliability logs for unusual crashes, bugchecks, or tcpip.sys-related instability around the suspected timeframe. Because no public exploit maturity, named actor activity, or unique exploit artifact was provided, detection should be behavior-based rather than IOC-only.

What your security team should do

• Patch affected Windows systems through the normal cumulative update process, prioritizing servers, privileged-access workstations, shared systems, and endpoints with remote logon exposure.
• Use asset inventory and vulnerability management data to identify all affected Windows 10, Windows 11, and Windows Server versions, including systems outside standard patch rings.
• Do not treat the low EPSS score or absence from CISA KEV as justification to ignore the issue; privilege escalation flaws are often chained with phishing, credential theft, or remote code execution vulnerabilities.
• Enforce least privilege by limiting local administrator membership, interactive logon rights, and remote desktop access for non-administrative users.
• Enable or review application control policies such as Microsoft Defender Application Control or AppLocker to reduce the ability to run unknown local exploit binaries.
• Monitor for post-exploitation behavior, especially low-privilege processes spawning SYSTEM-level shells, new services, scheduled tasks, credential dumping, or security control tampering.
• Confirm EDR and Windows security logging are enabled on affected systems before and after patching so attempted exploitation and follow-on actions can be investigated.
• Track Microsoft’s Security Update Guide for any revised fixed versions, exploitability assessment changes, or new mitigation details.