CVE-2026-40413

What it actually does

CVE-2026-40413 is a Windows TCP/IP stack denial-of-service vulnerability affecting multiple Windows client and server releases. The CVSS vector indicates adjacent-network exploitation, low attack complexity, no authentication, and no user interaction, with the primary consequence being high availability impact. In practical terms, a specially crafted network packet or packet sequence sent from the same local network segment could cause affected Windows systems to stop responding, crash, or otherwise lose network/system availability. There is no indication from the provided data that the flaw enables code execution, data theft, or privilege escalation.

Why it matters to the business

Successful exploitation can interrupt Windows workstations and servers on the same network segment as the attacker, potentially causing service outages, user disruption, failed business processes, and recovery work such as reboots or incident response. The risk is most relevant in networks where untrusted devices can share a broadcast domain, Wi-Fi network, VPN segment, data center VLAN, or server subnet with Windows systems. The CVSS score is high, but EPSS is currently low and stable, the issue is not listed in CISA KEV, and no mature public exploit is indicated, so remediation should be prioritized through normal patch cycles with higher urgency for exposed, shared, or high-availability Windows server networks.

How an attack unfolds

An attacker first needs network adjacency to a vulnerable Windows system, such as access to the same LAN, VLAN, Wi-Fi network, VPN segment, or compromised host on the same subnet. The attacker identifies reachable Windows targets and sends specially crafted TCP/IP traffic intended to trigger the vulnerable parsing or handling path in the Windows networking stack. If the target is vulnerable and the crafted traffic reaches it, the operating system may experience a denial-of-service condition, such as a crash, hang, network stack failure, or forced reboot. Because the vulnerability does not require authentication or user interaction, exposure is mainly controlled by network segmentation, local network access controls, and timely installation of Windows security updates.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-40413 for all affected Windows versions, including supported Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025 systems. Because no exact fixed build numbers were provided, validate remediation through Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or the Microsoft Update Catalog for the May 2026 security update or any later cumulative update applicable to each OS release. Where immediate patching is not possible, reduce exposure by restricting untrusted devices from sharing network segments with critical Windows systems, enforcing VLAN and ACL segmentation, limiting VPN client adjacency to server networks, monitoring for anomalous local network traffic, and prioritizing patching of domain controllers, file servers, virtualization hosts, remote access infrastructure, and other high-availability Windows servers.

How to confirm the fix worked

Confirm that each affected Windows endpoint and server has installed the Microsoft cumulative/security update that supersedes the May 2026 release for its specific OS version. Validate patch status using enterprise patch management reporting, Windows Update history, WSUS/SCCM compliance, or PowerShell-based inventory of installed hotfixes and OS build numbers. Confirm that no vulnerable Windows versions remain in unsupported or unpatched states. For exposure validation, review network architecture to determine whether untrusted users, guest Wi-Fi, unmanaged devices, VPN clients, or lower-trust subnets are adjacent to critical Windows systems. After patching, monitor for absence of recurring system crashes, bugchecks, or tcpip.sys-related failures under normal network conditions.

Typical attack path

1. Gain access to an adjacent network segment, such as the same LAN, VLAN, Wi-Fi, VPN, or compromised internal subnet.
2. Identify Windows hosts on that segment through passive observation, ARP/neighbor discovery, service discovery, or routine network scanning.
3. Send specially crafted TCP/IP traffic to the vulnerable Windows host.
4. Trigger the vulnerable TCP/IP handling path in the operating system.
5. Cause the target system or network stack to crash, hang, reboot, or become unavailable.
6. Repeat the traffic against multiple adjacent Windows systems to create broader service disruption.

How to detect it

To determine whether exploitation may have already occurred, focus on signs of unexplained Windows crashes or network-stack failures that correlate with inbound traffic from the same local network segment. Review Windows System event logs for unexpected reboots, bugchecks, Kernel-Power events, Windows Error Reporting events, and crash records referencing tcpip.sys. Collect and analyze memory dump files from affected systems, especially C:\Windows\MEMORY.DMP and minidumps under C:\Windows\Minidump\, looking for TCP/IP stack involvement. Correlate crash timestamps with firewall, switch, wireless controller, VPN, DHCP, NAC, EDR, and NDR telemetry to identify hosts that were adjacent to the victim and communicating immediately before the outage. Look for repeated crashes of multiple Windows systems in the same VLAN or subnet, which may indicate deliberate triggering rather than random instability. Because no public exploit maturity or specific packet signature is provided, detection should emphasize behavioral correlation: adjacent-source traffic immediately preceding bugchecks or reboots, repeated availability failures, and crash dumps implicating Windows networking components.

• tcpip.sys
• C:\Windows\MEMORY.DMP
• C:\Windows\Minidump\
• The computer has rebooted from a bugcheck
• Microsoft-Windows-WER-SystemErrorReporting
• Microsoft-Windows-Kernel-Power
• Event ID 1001
• Event ID 41
• BugCheck
• unexpected shutdown

What your security team should do

• Patch all affected Windows client and server systems with the applicable May 2026 or later cumulative security update, prioritizing critical servers and systems on shared or high-risk network segments.
• Treat adjacency as the key exposure factor: separate guest, BYOD, VPN, lab, OT, and low-trust networks from Windows server and administrative networks.
• Prioritize domain controllers, file servers, virtualization hosts, remote access gateways, management servers, and business-critical Windows workloads because exploitation primarily affects availability.
• Review VPN designs to ensure remote clients do not receive broad layer-2 or same-subnet access to sensitive Windows systems unless required.
• Monitor Windows System logs and crash artifacts for repeated bugchecks, unexpected reboots, or tcpip.sys references, especially when clustered by subnet or source network.
• Ensure endpoint and network teams have an outage response playbook for suspected network-triggered Windows crashes, including packet capture preservation and crash dump collection.
• Because EPSS is low, KEV status is false, and no exploit maturity is reported, handle as a high-impact availability patching item rather than an active mass-exploitation emergency unless local telemetry indicates otherwise.