CVE-2026-40408

What it actually does

This is a local privilege escalation vulnerability caused by a use-after-free condition in Windows Kernel-Mode Drivers. A low-privileged, already-authenticated attacker can trigger improper reuse of freed kernel memory to execute code with elevated kernel-level privileges. Successful exploitation can allow the attacker to gain SYSTEM-level control, bypass user-level restrictions, tamper with protected processes, access sensitive data, disable security tooling, and establish deeper persistence on the affected Windows host. The CVSS vector indicates local attack requirements, low attack complexity, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact.

Why it matters to the business

If exploited, this vulnerability can turn a limited foothold on a Windows workstation or server into full administrative control of that system. This materially increases the risk from phishing, stolen credentials, malware, insider misuse, and post-compromise lateral movement because an attacker who already has basic local access may be able to take over affected machines. Although it is not currently listed in CISA KEV, has no known ransomware association, has no reported mature exploit, and has a low stable EPSS score, the broad Windows desktop and server exposure means organizations should still treat it as an important routine patching priority, especially on internet-facing administration hosts, jump servers, developer workstations, domain-adjacent systems, and servers running sensitive workloads.

How an attack unfolds

An attacker first obtains local code execution as a standard user, for example through stolen credentials, malware delivery, abuse of a remote access tool, or compromise of a low-privileged service account. The attacker then runs a purpose-built exploit that interacts with the vulnerable Windows kernel-mode driver functionality and manipulates kernel memory allocation and object lifetime behavior. By causing the driver to reference memory after it has been freed, the attacker attempts to replace or control the freed memory with attacker-influenced data. If successful, the exploit changes kernel execution flow or corrupts security-relevant kernel structures to elevate the attacker’s privileges to SYSTEM or equivalent kernel-level authority. With elevated privileges, the attacker can dump credentials, disable endpoint controls, install services or drivers, access protected files, create or modify administrator accounts, and use the host as a platform for persistence or lateral movement. No named threat actors or public exploitation campaigns are currently associated with this vulnerability based on the provided data.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. Because no exact fixed build or package versions were provided, validate remediation against Microsoft’s official security update guidance for CVE-2026-40408 and ensure systems are updated to a build that includes the May 2026 or later security fix for the affected platform. Prioritize servers, privileged access workstations, jump hosts, administrator endpoints, systems used by help desk or IT operations staff, and hosts where standard users can run arbitrary code. Where immediate patching is not possible, reduce exposure by limiting interactive logon rights, removing unnecessary local users and administrators, enforcing application control, blocking untrusted executables, restricting driver installation, enabling credential protection features, and ensuring endpoint detection and response controls are active and tamper-protected.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft security update that remediates this vulnerability or is running a Windows build that supersedes the vulnerable version. Use centralized patch management, endpoint inventory, vulnerability scanners, or Windows Update compliance reporting to verify update status across Windows 10, Windows 11, and Windows Server assets. On individual systems, verify OS build and installed cumulative updates using supported administrative tooling such as Windows Update history, Get-HotFix, systeminfo, or enterprise endpoint management inventory. Re-scan assets with an authenticated vulnerability scanner after patching and confirm the finding is no longer reported. For mitigation validation, confirm that non-administrative users cannot install drivers, run unsigned or unapproved binaries, tamper with security tools, or obtain local administrator rights outside approved privilege management workflows.

Typical attack path

1. Obtain local access to an affected Windows workstation or server with a low-privileged account.
2. Transfer or stage a local privilege escalation exploit on the host.
3. Execute the exploit to trigger the use-after-free condition in the Windows Kernel-Mode Drivers component.
4. Manipulate freed kernel memory so the kernel performs attacker-controlled operations or corrupts privilege-related structures.
5. Escalate from low-privileged user context to SYSTEM or kernel-level privileges.
6. Use elevated access to disable defenses, dump credentials, install persistence, access sensitive data, or move laterally.

How to detect it

There are no specific public exploit indicators, file names, network signatures, or threat actor tradecraft provided for this vulnerability. Detection should therefore focus on behavioral evidence of local privilege escalation and post-exploitation activity on Windows hosts. Review endpoint detection telemetry, Windows Security logs, Sysmon logs, PowerShell logs, Windows Defender or EDR alerts, driver load events, service creation events, process creation telemetry, and account management events. Look for a low-privileged user account spawning processes that quickly transition to SYSTEM, unexpected creation of local administrators, suspicious service installation, unsigned or unusual driver loads, kernel crash events near suspicious process execution, security tool tampering, credential dumping attempts, abnormal LSASS access, and new persistence mechanisms. Useful Windows event sources include Security event logs for process creation, privilege use, account changes, service installation, and logon activity; System logs for driver and service events; PowerShell Operational logs for script execution; and EDR telemetry for token manipulation, exploit prevention, memory corruption, and kernel exploit alerts. Because exploitation is local, network logs alone are unlikely to show the exploit, but they may reveal preceding access or subsequent lateral movement.

What your security team should do

• Inventory all affected Windows desktop and server versions and identify systems missing the Microsoft security update that fixes this vulnerability.
• Prioritize patching of servers, administrator workstations, jump hosts, domain-adjacent systems, shared workstations, and endpoints used by privileged users.
• Treat this as a post-compromise privilege escalation risk: pair patching with monitoring for suspicious local privilege escalation, credential dumping, security tool tampering, and new persistence mechanisms.
• Review and reduce local administrator membership, interactive logon rights, and service account privileges on Windows systems.
• Ensure endpoint protection, EDR, tamper protection, credential protection, and application control policies are enabled on high-value Windows assets.
• Monitor for unusual child processes, privilege changes, new services, driver loads, LSASS access attempts, and unexpected administrative account creation following low-privileged user activity.
• Because EPSS is low and no public exploit maturity is reported, include this in normal high-priority Windows patch cycles rather than emergency response unless exploitation indicators emerge or asset criticality warrants acceleration.