CVE-2026-44805

What it actually does

This is a local, authenticated use-after-free flaw in the Windows Network Controller Host Agent on affected Windows Server versions. A low-privileged local user can trigger incorrect memory reuse in the Host Agent process, causing the service to crash or become unavailable. The assessed impact is denial of service only: there is no indicated confidentiality or integrity impact, no remote attack vector, and no user interaction requirement.

Why it matters to the business

Successful exploitation can disrupt Software Defined Networking management functions on Windows Server systems using the Network Controller Host Agent, potentially affecting host networking operations, management-plane stability, and administrative visibility. The risk is most relevant on multi-user servers, virtualization hosts, or SDN deployments where untrusted or semi-trusted users can obtain local access. It is not currently listed in CISA KEV, has low EPSS, and has no reported public exploit maturity, so prioritization should be risk-based but still included in normal Windows Server patch cycles.

How an attack unfolds

An attacker first needs local access to an affected Windows Server system with at least low-privileged authorization. The attacker then interacts with the Windows Network Controller Host Agent through local service interfaces or host-side management functionality in a way that causes the agent to release memory and later reference it again. This stale memory access can produce an access violation or similar fault, terminating the Host Agent process or leaving the Network Controller host-side component unavailable. The likely attacker objective is operational disruption rather than code execution or data theft.

How to fix it

Apply the Microsoft security update or cumulative update that addresses this vulnerability for the affected Windows Server release as soon as it is available through the Microsoft Security Update Guide, Windows Update, WSUS, or enterprise patch management. Because no exact fixed build versions were provided, validate remediation against Microsoft’s official advisory for Windows Server 2019, Windows Server 2022, and Windows Server 2025. Where the Network Controller Host Agent is not required, remove or disable the Network Controller/SDN host component to reduce exposure. Limit local logon rights and administrative access on servers running this role, and prevent untrusted users from obtaining interactive, RDP, scheduled-task, or service-execution access.

How to confirm the fix worked

Confirm whether the Network Controller Host Agent role/component is installed and whether its service is present and running. Verify the server has the applicable Microsoft cumulative/security update installed for its Windows Server version and that the OS build matches or exceeds the fixed level documented by Microsoft. After patching, restart the service or host if required and confirm the Host Agent remains stable under normal SDN/Network Controller operations. Exposure can be reduced if the component is absent, disabled, or inaccessible to low-privileged local users.

Typical attack path

1. Gain local authenticated access to an affected Windows Server 2019, 2022, or 2025 system.
2. Confirm the Windows Network Controller Host Agent component is installed and running.
3. Invoke local interactions with the Host Agent that exercise the vulnerable memory-management path.
4. Trigger the use-after-free condition, causing the Host Agent process or service to crash.
5. Repeat the trigger as needed to sustain denial of service until the component is restarted, disabled, or patched.

How to detect it

Look for evidence of repeated crashes or restarts of the Windows Network Controller Host Agent, especially when correlated with local logon activity, new process creation, scheduled tasks, or script execution by low-privileged accounts. Useful log sources include Windows System logs, Service Control Manager events, Windows Application logs, Windows Error Reporting events, Security logs for local logons and process execution if enabled, PowerShell Operational logs, Sysmon process/service telemetry, and any Network Controller Host Agent operational/admin event channels. Hunt for Event ID 7031 or 7034 service termination events, Application Error Event ID 1000 referencing the Host Agent executable, Windows Error Reporting Event ID 1001, crash dumps for the Host Agent process, and repeated service recovery actions. Because this vulnerability causes denial of service rather than a unique network callback or file artifact, detection should focus on abnormal crash frequency, timing near suspicious local activity, and recurrence after service restart.

• NcHostAgent
• NcHostAgent.exe
• Network Controller Host Agent
• Microsoft Network Controller Host Agent
• Microsoft-Windows-NetworkController-HostAgent
• Event ID 7031
• Event ID 7034
• Event ID 1000
• Event ID 1001
• Service Control Manager
• Application Error
• Windows Error Reporting
• C:\Windows\System32\NcHostAgent.exe

What your security team should do

• Inventory Windows Server 2019, 2022, and 2025 systems for the Network Controller Host Agent or SDN host components.
• Prioritize patching servers where local access is available to multiple users, administrators, automation accounts, or tenant/workload operators.
• Apply the relevant Microsoft cumulative/security update through standard Windows Server patch management once available and verify installation status.
• Disable or remove the Network Controller Host Agent where the SDN/Network Controller role is not in use.
• Review local logon, RDP, scheduled task, service creation, and PowerShell remoting permissions to reduce the number of users who can execute code locally on affected servers.
• Monitor for repeated Host Agent crashes, Windows Error Reporting events, and Service Control Manager restart events that may indicate attempted exploitation.
• Because this issue is not in KEV and has low EPSS/no known exploit maturity, handle as a normal-to-elevated availability patching item unless the affected hosts are critical SDN infrastructure.