CVE-2026-42981

What it actually does

CVE-2026-42981 is a network-reachable integer underflow in Windows Performance Monitor affecting Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025. A specially crafted remote request can cause arithmetic wraparound during Performance Monitor processing, leading to memory corruption and potential arbitrary code execution. The vulnerability is unauthenticated and requires no user interaction, but exploitation complexity is rated high, meaning reliable exploitation likely depends on precise heap state, target configuration, or timing conditions. Successful exploitation could allow execution in the context of the vulnerable Windows service or process handling the Performance Monitor request, with confidentiality, integrity, and availability impact.

Why it matters to the business

If exploited, this flaw could let an external or internal attacker take control of affected Windows workstations or servers that expose the vulnerable Performance Monitor functionality over the network. Compromise of servers could disrupt operations, enable lateral movement, allow data theft, or provide a foothold for broader domain compromise. The current public exploitation signal is low: EPSS is 0.0064 with no 30-day increase, there is no known exploit maturity, it is not listed in CISA KEV, and it is not currently associated with ransomware campaigns. However, because the issue is unauthenticated remote code execution on widely deployed Windows platforms, organizations should still treat patching as a high-priority infrastructure maintenance item, especially for exposed servers and management networks.

How an attack unfolds

An attacker first identifies Windows systems that allow remote access to Performance Monitor-related services or RPC interfaces. The attacker then sends malformed network traffic designed to trigger an integer underflow during Performance Monitor data handling. If the arithmetic wraparound results in controllable memory corruption, the attacker may cause a crash or, with sufficient precision, redirect execution flow to attacker-controlled code. A successful exploit would establish code execution on the target host, after which the attacker would typically deploy a payload, create persistence, dump credentials, disable monitoring, or move laterally to other Windows systems. Because exploitation complexity is high and no public exploit maturity is reported, failed exploitation attempts may appear as service crashes, application faults, or abnormal RPC activity before reliable code execution is achieved.

How to fix it

Apply the Microsoft security update or cumulative update that remediates CVE-2026-42981 for all affected Windows versions as soon as it is available through Windows Update, WSUS, Microsoft Update Catalog, or enterprise patch tooling. No package-specific fixed versions were provided in the input, so remediation should be validated against Microsoft’s official security update guidance for Windows 11 23H2, 24H2, 25H2, 26H1, Windows Server 2022, and Windows Server 2025. Where immediate patching is not possible, reduce exposure by restricting inbound RPC/DCOM and Windows management traffic to trusted administration hosts only, blocking unnecessary access to TCP 135 and dynamic RPC ports from untrusted networks, limiting SMB exposure, disabling remote Performance Monitor collection where not required, and enforcing host firewalls on servers and workstations. Prioritize internet-facing systems, systems reachable from user subnets, domain controllers, management servers, monitoring targets, and high-value servers.

How to confirm the fix worked

Confirm remediation by verifying that affected Windows systems have installed the relevant Microsoft cumulative/security update containing the fix and that OS build numbers match Microsoft’s patched build guidance. Use enterprise vulnerability scanners, authenticated configuration checks, or patch compliance tools to enumerate Windows 11 and Windows Server 2022/2025 assets and flag systems missing the applicable update. Validate network exposure by confirming that remote Performance Monitor/RPC access is restricted to approved management networks and that TCP 135, TCP 445, and dynamic RPC ports are not broadly reachable from untrusted segments. Review Windows Event Logs for recent crashes or abnormal activity involving Performance Monitor-related components before and after patching. Where available, perform a safe authenticated vulnerability scan rather than attempting exploit validation.

Typical attack path

1. Scan for Windows 11, Windows Server 2022, or Windows Server 2025 systems reachable over management or internal network paths.
2. Identify hosts exposing remote Performance Monitor, RPC, DCOM, SMB, or related Windows management access from untrusted or broad network segments.
3. Send crafted network requests intended to exercise vulnerable Performance Monitor parsing or counter-handling code paths.
4. Trigger integer underflow and memory corruption in the vulnerable Windows component.
5. Achieve process crash or arbitrary code execution, depending on exploit reliability and target conditions.
6. Run a payload under the compromised process context.
7. Perform post-exploitation actions such as credential access, discovery, lateral movement, persistence, or data staging.

How to detect it

To determine whether exploitation may have already occurred, review Windows telemetry from affected hosts for crashes, service restarts, and suspicious follow-on activity around Performance Monitor or Windows management components. Relevant sources include Windows Application logs, System logs, Security logs, Windows Error Reporting events, Sysmon process and network events, EDR telemetry, firewall logs, RPC/SMB connection logs, and crash dump directories. Look for application fault events involving Performance Monitor, PDH, performance counter libraries, MMC-based Performance Monitor sessions, or unexpected terminations of services associated with performance logging. Correlate these events with inbound connections to TCP 135, TCP 445, and dynamic RPC ports from unusual internal hosts, external addresses, user workstations, or systems that do not normally perform monitoring. Because no public exploit indicators or named threat actors are currently associated with this CVE, detection should focus on behavioral evidence: repeated crashes followed by new processes, unusual child processes, credential access tools, new services, scheduled tasks, unexpected administrator logons, or lateral movement from the affected host.

• Faulting application name: perfmon.exe
• Faulting application name: mmc.exe
• Faulting module name: pdh.dll
• Faulting module name: perflib.dll
• Faulting module name: pla.dll
• Windows Error Reporting
• Application Error
• Performance Logs & Alerts
• C:\Windows\System32\perfmon.exe
• C:\Windows\System32\pdh.dll
• C:\Windows\System32\perflib.dll
• C:\Windows\System32\pla.dll
• C:\ProgramData\Microsoft\Windows\WER\ReportArchive
• C:\ProgramData\Microsoft\Windows\WER\ReportQueue
• TCP/135
• TCP/445

What your security team should do

• Inventory all Windows 11 23H2, 24H2, 25H2, 26H1, Windows Server 2022, and Windows Server 2025 systems and identify those reachable over management, monitoring, RPC, or SMB network paths.
• Prioritize patching of servers, administrative systems, monitoring targets, and hosts reachable from less-trusted networks.
• If patching is delayed, restrict remote Performance Monitor and RPC/DCOM access to trusted management hosts using Windows Defender Firewall, network ACLs, or segmentation controls.
• Hunt for unexplained crashes or restarts of Performance Monitor-related processes and services, especially around inbound RPC or SMB connections from unusual sources.
• Add SIEM detections for Windows application crashes involving Performance Monitor components and correlate with network telemetry showing inbound connections to RPC/SMB management ports.
• Review remote monitoring configurations and remove unnecessary broad access to performance counters.
• Maintain heightened monitoring despite low current EPSS and no KEV listing, because unauthenticated network RCE flaws in Windows often become more attractive after patches are released and reverse-engineered.