CVE-2026-40401

What it actually does

CVE-2026-40401 is a denial-of-service flaw in the Microsoft Windows TCP/IP implementation. As scored, exploitation is local, low-complexity, requires no privileges, and does not require user interaction. Successful exploitation can cause a high-impact availability failure, such as a system crash, hang, or forced restart affecting the Windows host and any workloads or network services running on it. The issue does not indicate direct confidentiality loss, data tampering, or code execution, but because it affects core networking functionality, the operational blast radius can include service interruption for applications hosted on vulnerable Windows client or server systems.

Why it matters to the business

An attacker who can reach a vulnerable Windows system with the required local execution context could disrupt business services by causing affected endpoints or servers to crash or become unavailable. For servers, this may interrupt authentication, file sharing, application hosting, remote access, or other Windows-based services until systems recover or are restarted. The current exploitation signal is low: EPSS is 0.00331, unchanged over 30 days, there is no known public exploit maturity, it is not listed in CISA KEV, and it is not known to be used in ransomware campaigns. Even so, affected versions include broadly deployed Windows 10, Windows 11, and Windows Server releases, so remediation should be handled through normal patch management with higher priority for internet-facing, shared, critical, or high-availability Windows servers.

How an attack unfolds

An attacker first needs a way to execute activity locally on a vulnerable Windows host or otherwise reach the vulnerable local attack surface described by the CVSS vector. They then trigger a vulnerable TCP/IP code path using crafted local input, traffic generation, or networking operations that cause the Windows TCP/IP stack to mishandle state or memory. The result is a denial of service: the system may bug check, reboot, hang, lose networking, or stop serving dependent workloads. Because the vulnerability is assessed as denial of service only, exploitation is expected to focus on disruption rather than persistence, credential theft, or data modification. There are currently no named threat actors, KEV listing, or known ransomware use associated with this issue.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-40401 for all affected Windows versions. Because no exact fixed build numbers were provided, use the applicable Microsoft cumulative update released on or after the May 2026 security update cycle for each supported Windows version. Prioritize Windows Server systems, systems supporting critical business services, shared infrastructure, remote access hosts, and high-availability clusters. Where immediate patching is not possible, reduce the likelihood and impact of exploitation by limiting local code execution opportunities, enforcing least privilege, restricting interactive logon to servers, applying application control, isolating critical workloads, and ensuring affected systems can fail over or restart cleanly. Unsupported or end-of-life Windows deployments should be upgraded to a supported release or covered by applicable extended security updates if available.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows system has installed the relevant Microsoft cumulative security update released on or after the fix date for this vulnerability. Use enterprise patch management, Windows Update history, Microsoft Defender Vulnerability Management, WSUS, Intune, SCCM/MECM, or PowerShell-based inventory to confirm update installation and OS build compliance. Validate that all affected product families are covered, including Windows 10 1607, 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H1; Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025. After patching, monitor for stability and ensure no recurring bug checks, unexpected shutdowns, or TCP/IP-related failures are observed. For high-availability services, conduct controlled failover or maintenance validation to confirm patching did not leave unpatched nodes in service.

Typical attack path

1. Gain local execution capability on a vulnerable Windows client or server, such as through prior compromise, malicious local process execution, or abuse of an allowed local workload.
2. Identify that the host is running an affected Windows release, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, 2022 23H2, or 2025.
3. Trigger the vulnerable Windows TCP/IP processing path using crafted local networking operations or input.
4. Cause the host to crash, hang, reboot, or lose networking functionality.
5. Leverage the resulting outage to disrupt hosted services, degrade availability, or interfere with operations and incident response.

How to detect it

Detection should focus on evidence of successful or attempted denial-of-service activity rather than a unique exploit signature, because no public exploit indicators are known from the provided intelligence. Review Windows System logs for unexpected shutdowns, bug checks, restarts, TCP/IP driver errors, and network stack instability, especially on unpatched affected systems. Useful log sources include Windows System Event Log, Windows Application Event Log, Windows Error Reporting, crash dump directories, EDR process telemetry, PowerShell logs, scheduled task logs, service control logs, and network monitoring around the time of outage. Investigate Event ID 1001 BugCheck, Event ID 41 Kernel-Power, Event ID 6008 unexpected shutdown, service failures, and Tcpip/NDIS/NetBT-related errors clustered around the same time. Correlate crashes with preceding local execution activity, newly created executables, scripts, suspicious command lines, unusual user logons, or repeated network-manipulation commands. Because this is not KEV-listed and has low EPSS with no known exploit maturity, absence of specific IOCs does not prove safety; prioritize patch validation and anomaly-based investigation for unexplained crashes.

• Event ID 1001
• BugCheck
• Event ID 41
• Kernel-Power
• Event ID 6008
• The previous system shutdown was unexpected
• Event ID 7031
• Event ID 7034
• Tcpip
• NDIS
• NetBT
• C:\Windows\MEMORY.DMP
• C:\Windows\Minidump\
• C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_
• C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_
• Microsoft-Windows-WER-SystemErrorReporting
• Microsoft-Windows-Kernel-Power
• Microsoft-Windows-TCPIP

What your security team should do

• Inventory all Windows client and server versions listed as affected and map them to patch status.
• Prioritize patching of Windows servers that host critical services, shared workloads, remote access, or high-availability infrastructure.
• Deploy the applicable Microsoft cumulative security updates released on or after the May 2026 security update cycle.
• Restrict local logon and local code execution paths on servers, especially for non-administrative users and service accounts.
• Use application control, endpoint protection, and least-privilege enforcement to reduce the chance that an attacker can run local exploit code.
• Monitor Windows System event logs for unexpected shutdowns, bug checks, repeated reboots, TCP/IP driver errors, or sudden service outages.
• Correlate suspected crash events with preceding local process execution, new binaries, scripting activity, scheduled tasks, or unusual user sessions.
• Treat repeated unexplained crashes on unpatched systems as potentially suspicious even though public exploitation is not currently known.
• Ensure business-critical Windows services have tested recovery, restart, and failover procedures.
• Track Microsoft advisories for any later clarification, exploit publication, or fixed build details.