CVE-2026-42974

What it actually does

CVE-2026-42974 is a network-reachable integer underflow in Windows Performance Monitor. A specially crafted request or data structure processed by the Performance Monitor service can cause arithmetic wraparound, leading to memory corruption. If exploitation succeeds, an unauthenticated remote attacker could execute arbitrary code in the context of the affected Windows component, potentially gaining control over the host. The CVSS vector indicates no privileges or user interaction are required, but exploitation complexity is high, meaning reliable exploitation likely depends on precise service state, memory layout, or protocol conditions.

Why it matters to the business

Successful exploitation could allow a remote attacker to compromise affected Windows workstations or servers, install malware, steal data, disrupt operations, or use the system as a foothold for lateral movement. Because supported Windows client and server versions are affected, exposure may be broad in enterprises. Current public exploitation indicators are limited: EPSS is low and flat, it is not listed in CISA KEV, and no mature exploit is reported, but the potential impact is severe because unauthenticated remote code execution on Windows infrastructure can become business-critical if exploit code emerges.

How an attack unfolds

An attacker first identifies Windows systems exposing the vulnerable Performance Monitor functionality over the network. They then send crafted network traffic designed to trigger an integer underflow during Performance Monitor request handling. If the arithmetic wraparound causes incorrect memory sizing, indexing, or bounds handling, the attacker attempts to shape memory corruption into controlled code execution. A successful exploit would result in attacker-controlled code running on the target without prior authentication or user interaction. From there, the attacker would commonly establish persistence, execute discovery commands, dump credentials where possible, move laterally to other Windows systems, or deploy payloads such as remote access tools, data theft utilities, or ransomware. No specific threat actors or active campaigns are currently associated with this vulnerability based on the provided information.

How to fix it

Apply the Microsoft security update that remediates this vulnerability for all affected Windows versions: Windows 11 23H2, 24H2, 25H2, 26H1, Windows Server 2022, and Windows Server 2025. Because no exact fixed build numbers were provided, use the latest cumulative update or security update available from Microsoft for each affected OS release and verify that it includes the June 2026 or later security fixes for this CVE. Prioritize internet-facing systems, servers reachable from untrusted networks, management networks, jump hosts, and systems where Performance Monitor or remote performance data collection is enabled. If immediate patching is not possible, reduce exposure by blocking unnecessary inbound access to Windows performance monitoring interfaces, restricting remote performance monitoring to trusted administrative hosts, enforcing host firewall rules, and segmenting management services from user and internet-facing networks.

How to confirm the fix worked

Confirm that each affected system has installed the Microsoft cumulative/security update that includes the fix for CVE-2026-42974. Validate via Windows Update history, enterprise patch management inventory, or PowerShell checks for installed hotfixes and OS build numbers, then compare against Microsoft’s official security update guidance for the relevant Windows release. From a network perspective, verify that performance monitoring-related remote access is not reachable from untrusted networks. Where possible, perform authenticated vulnerability scanning after patch deployment to confirm the host is no longer reported as vulnerable. Also validate compensating controls by testing that host firewall or network ACL rules block unauthorized remote access to Performance Monitor-related services.

Typical attack path

1. Scan for affected Windows 11 or Windows Server systems with Performance Monitor-related network interfaces reachable.
2. Fingerprint OS version and exposed services to identify likely vulnerable targets.
3. Send specially crafted Performance Monitor traffic that triggers the integer underflow condition.
4. Exploit resulting memory corruption to gain remote code execution on the target host.
5. Deploy a payload such as a command shell, loader, or remote access tool.
6. Perform host reconnaissance, credential access, privilege escalation, and lateral movement as needed.
7. Establish persistence or carry out the final objective, such as data theft, service disruption, or malware deployment.

How to detect it

To assess whether exploitation may already have occurred, review Windows Event Logs, Sysmon telemetry, EDR alerts, firewall logs, NetFlow, and crash dumps around Performance Monitor activity. Focus on unexpected inbound connections to Windows management or performance monitoring services from untrusted hosts, repeated service crashes, abnormal memory access violations, or sudden restarts of Performance Monitor-related components. Investigate any suspicious child processes launched by service-hosting processes, especially command shells, scripting engines, download utilities, credential tools, or unknown binaries shortly after anomalous network activity. Relevant log sources include Windows System and Application event logs, Microsoft-Windows-WMI-Activity/Operational, PowerShell Operational logs, Security logs for process creation if enabled, Sysmon Event IDs 1, 3, 7, 10, 11, and 22, EDR process trees, Windows Defender alerts, and perimeter/internal firewall records. Since no public exploit pattern or actor-specific tooling is provided, detection should combine exposure evidence, crash/anomaly evidence, and generic post-exploitation behaviors rather than relying solely on a single signature.

• perfmon.exe
• perfproc.dll
• perfdisk.dll
• pla.dll
• typeperf.exe
• logman.exe
• relog.exe
• svchost.exe spawning cmd.exe
• svchost.exe spawning powershell.exe
• svchost.exe spawning pwsh.exe
• svchost.exe spawning wscript.exe
• svchost.exe spawning cscript.exe
• svchost.exe spawning rundll32.exe
• svchost.exe spawning regsvr32.exe
• svchost.exe spawning mshta.exe
• Windows Error Reporting crash involving perfmon.exe
• Application Error perfmon.exe
• Faulting application name: perfmon.exe
• Faulting module name: perfproc.dll
• Faulting module name: perfdisk.dll
• Microsoft-Windows-WMI-Activity/Operational
• Microsoft-Windows-PowerShell/Operational
• Event ID 1000 Application Error
• Event ID 7031 Service Control Manager
• Event ID 4688 cmd.exe
• Event ID 4688 powershell.exe
• Sysmon Event ID 1
• Sysmon Event ID 3
• Sysmon Event ID 10

What your security team should do

• Prioritize patching affected Windows Server 2022 and Windows Server 2025 systems, especially systems reachable from untrusted networks or used for administration, monitoring, or identity-adjacent operations.
• Deploy the latest Microsoft cumulative updates to affected Windows 11 endpoints and servers, then verify installation through centralized patch reporting.
• Restrict remote Performance Monitor access to trusted administrative networks and hosts only; block unnecessary inbound management traffic at host and network firewalls.
• Review exposure of Windows management services across internet-facing, DMZ, VPN-accessible, and internal networks to reduce unauthenticated reachability.
• Enable or tune detections for unusual inbound connections to Windows performance monitoring interfaces, unexpected crashes of Performance Monitor-related services, and post-exploitation behaviors such as suspicious child processes, credential dumping, and lateral movement.
• Because EPSS is currently low, not trending upward, and the CVE is not in CISA KEV, treat this as high-impact but not currently known-exploited; continue monitoring Microsoft advisories, exploit repositories, and threat intelligence for changes in exploit maturity.
• For systems that cannot be patched promptly, document compensating controls, isolate the systems, and increase monitoring for anomalous service crashes and remote management activity.