CVE-2026-44806

What it actually does

CVE-2026-44806 is a remotely reachable denial-of-service vulnerability in Microsoft Windows Cryptographic Services caused by missing release of memory after its effective lifetime. An unauthenticated network attacker can trigger repeated vulnerable cryptographic service code paths, causing memory consumption to grow over time. Successful exploitation can degrade or interrupt availability of the affected Windows host or dependent services, but the flaw does not provide code execution, privilege escalation, data disclosure, or direct integrity compromise based on the published CVSS vector.

Why it matters to the business

Affected Windows client and server systems may become slow, unstable, or temporarily unavailable if targeted, disrupting authentication, certificate validation, software update validation, secure communications, or applications that rely on Windows cryptographic functions. The CVSS score is moderate and EPSS is currently low, with no CISA KEV listing or ransomware association reported, but the unauthenticated network attack surface means internet-facing or business-critical Windows servers should still be prioritized in routine patch cycles.

How an attack unfolds

An attacker first identifies a reachable affected Windows system that exposes the relevant network-accessible cryptographic service behavior. They then send crafted or repeated network requests that cause Windows Cryptographic Services to allocate memory without properly releasing it. As the attack continues, memory pressure increases in the service-hosting process or the system overall. Eventually, the host may experience service degradation, process termination, resource exhaustion events, failed cryptographic operations, or broader availability impact. Because the vulnerability is denial-of-service only, the attacker’s objective is disruption rather than persistence or control of the system.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows versions, including Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. No exact fixed build numbers were provided in the input, so use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or the Microsoft Update Catalog to deploy the security update that supersedes this vulnerability for each supported OS build. Where immediate patching is not possible, reduce exposure by restricting network access to affected systems, placing critical servers behind firewalls or segmentation controls, limiting access to trusted sources, and monitoring or rate-limiting suspicious traffic patterns that correlate with memory growth. Reboot systems as required after patching to ensure the vulnerable binaries and service-hosting processes are replaced and restarted.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows host has installed the Microsoft security update that addresses CVE-2026-44806 for its OS build. Validate through Windows Update history, installed hotfix inventory, endpoint management compliance reports, or vulnerability scanner plugin results. After patching and rebooting, confirm Cryptographic Services is running normally and that memory usage for the relevant svchost.exe instance remains stable under normal cryptographic workloads. For exposure validation, inventory affected OS versions and identify systems reachable from untrusted networks; prioritize servers with public exposure or high operational dependency on certificate, signing, update, or TLS-related functions.

Typical attack path

1. Identify Windows 10, Windows 11, or Windows Server systems potentially affected by the vulnerable Cryptographic Services implementation.
2. Confirm the target is reachable over the network and can be made to exercise the vulnerable cryptographic service code path.
3. Send crafted or high-volume requests that trigger memory allocation without corresponding release.
4. Sustain or repeat the requests until memory usage increases materially on the target.
5. Cause degraded performance, service failure, resource exhaustion, or partial host unavailability.
6. Stop or vary the traffic to evade simple rate-based detection or to repeatedly re-trigger the denial-of-service condition.

How to detect it

To assess possible prior exploitation, review Windows System, Application, and Microsoft-Windows-Resource-Exhaustion-Detector logs for resource exhaustion, low-memory conditions, or Cryptographic Services instability on affected systems. Correlate spikes in memory usage by svchost.exe instances hosting CryptSvc with inbound network traffic from the same external sources or with repeated connection attempts shortly before degradation. Examine performance telemetry, EDR process histories, Windows Error Reporting events, Service Control Manager events, firewall logs, load balancer logs, and NetFlow records for repeated unauthenticated network activity followed by memory pressure or service interruption. Look for repeated failures of certificate validation, signing verification, Windows Update validation, or TLS-dependent applications that coincide with system memory growth. There are no public exploit-specific payload strings in the provided data, so detection should focus on behavioral evidence of remote-triggered memory exhaustion rather than a unique packet signature.

• CryptSvc
• Cryptographic Services
• svchost.exe
• Service Control Manager
• Event ID 7031
• Event ID 7034
• Event ID 2004
• Microsoft-Windows-Resource-Exhaustion-Detector
• Windows successfully diagnosed a low virtual memory condition
• Resource-Exhaustion-Detector
• Windows Error Reporting
• Application Error
• low virtual memory
• The Cryptographic Services service terminated unexpectedly

What your security team should do

• Patch affected Windows client and server systems through the standard Microsoft security update process, prioritizing internet-facing and business-critical servers first.
• Use vulnerability management tooling to identify Windows 10, Windows 11, and Windows Server assets still missing the relevant security update.
• Restrict inbound network access to affected systems where patching cannot be completed promptly, especially from untrusted networks.
• Monitor for abnormal memory growth, resource exhaustion events, or repeated Cryptographic Services failures on unpatched systems.
• Create temporary operational alerts for Event ID 2004 resource exhaustion and Service Control Manager events involving Cryptographic Services until patch compliance is complete.
• Review service availability monitoring for unexplained outages or restarts on affected systems since publication.
• Because exploitation maturity is currently reported as none and EPSS is low, treat this as a routine but time-bound remediation item unless exposure is public or business critical.