CVE-2026-45657

What it actually does

This is a use-after-free vulnerability in the Windows Kernel that can allow memory corruption leading to remote code execution. The CVSS vector indicates the issue is network-accessible, requires low attack complexity, requires no authentication, requires no user interaction, and can compromise confidentiality, integrity, and availability. Successful exploitation could allow an attacker to execute arbitrary code in a highly privileged kernel context, potentially resulting in full system compromise, security control bypass, credential access, lateral movement, or system instability.

Why it matters to the business

Affected Windows workstations and servers may be remotely compromised without user interaction if exposed to the vulnerable attack surface. Because impacted products include current Windows 11 releases and Windows Server 2022/2025, exploitation could affect both endpoints and critical server workloads. Although this vulnerability is not currently listed in CISA KEV and exploit maturity is reported as none, the severity is critical, the attack requires no authentication, and the EPSS score indicates measurable exploitation interest; organizations should treat remediation as high priority to reduce the risk of ransomware deployment, service disruption, data theft, and broad internal network compromise.

How an attack unfolds

An attacker first identifies Windows systems running affected versions such as Windows 11 23H2 through 26H1, Windows Server 2022, or Windows Server 2025. The attacker then sends specially crafted network traffic to the vulnerable Windows kernel attack surface. The malformed interaction triggers a use-after-free condition, causing the kernel to reference memory after it has been freed. By shaping heap state and timing the request, the attacker attempts to replace or control the freed memory region so that kernel execution follows attacker-controlled data. If successful, the attacker achieves arbitrary code execution with kernel-level privileges. From there, they may install persistence, disable security tooling, dump credentials, move laterally, encrypt files, or use the host as a foothold for broader network compromise. Public exploitation is not currently indicated by KEV or exploit-maturity data, but the low-complexity, unauthenticated network vector makes rapid patching important.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-45657 as soon as it is available for the affected Windows releases. Fixed package versions were not provided in the input, so use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, Intune, or the Microsoft Security Update Guide to identify and deploy the applicable cumulative update for Windows 11 23H2, 24H2, 25H2, 26H1, Windows Server 2022, and Windows Server 2025. Prioritize externally reachable servers, domain-joined servers, remote access infrastructure, high-value administrative workstations, and systems with broad internal network exposure. If immediate patching is not possible, reduce exposure by blocking unnecessary inbound traffic at host and network firewalls, restricting access to Windows services to trusted management networks or VPNs, disabling unused network services and protocols, enforcing segmentation between workstations and servers, and increasing monitoring for kernel crashes or suspicious post-exploitation activity. Mitigations should be treated as temporary controls, not substitutes for patching.

How to confirm the fix worked

Confirm remediation by verifying that each affected system has installed the relevant Microsoft cumulative security update released to address this vulnerability or a later superseding update. Use authenticated vulnerability scanning, endpoint management inventory, Windows Update history, PowerShell-based patch inventory, or enterprise patch-management reporting to confirm update installation across Windows 11 and Windows Server assets. Validate that externally exposed Windows systems are not reachable on unnecessary inbound services from the internet. Confirm firewall and segmentation policies restrict access to required sources only. After patching, reboot systems where required and re-run vulnerability scans to ensure the finding is cleared. Where exact fixed build numbers or KBs are not available from the input, cross-check against the Microsoft Security Update Guide for this CVE before closing remediation work.

Typical attack path

1. Scan for internet-facing or internally reachable Windows endpoints and servers running affected versions.
2. Identify reachable Windows network services or kernel-exposed network attack surfaces.
3. Send crafted network traffic designed to trigger the use-after-free condition.
4. Manipulate memory layout so freed kernel memory is reused in an attacker-controlled way.
5. Gain arbitrary code execution in kernel context if exploitation succeeds.
6. Disable or evade endpoint protections and collect credentials or tokens.
7. Establish persistence and expand access to additional systems.
8. Conduct follow-on actions such as data theft, ransomware deployment, or service disruption.

How to detect it

To determine whether exploitation may already have occurred, review host, endpoint, network, and identity telemetry for signs of remote kernel exploitation followed by post-compromise activity. Start with Windows System logs for unexpected bugchecks, reboots, service failures, or crash patterns on affected Windows versions, especially where preceded by unusual inbound network traffic. Review EDR telemetry for kernel-level alerts, suspicious driver loading, security tool tampering, LSASS access, credential dumping behavior, new services, scheduled tasks, new local administrators, unusual PowerShell or command execution, and outbound connections shortly after crashes or anomalous network sessions. Review firewall, IDS/IPS, NetFlow, and Windows Filtering Platform telemetry for malformed or high-volume inbound traffic to Windows services from untrusted sources. Because no public exploit pattern, threat actor, protocol, payload signature, or KEV exploitation has been provided, detection should focus on behavioral evidence: crash-then-compromise sequences, unexpected privileged process execution, lateral movement from affected hosts, and persistence created shortly after suspicious inbound traffic. Preserve memory images, crash dumps, EDR timelines, and network captures for any suspected systems before reimaging.

What your security team should do

• Prioritize patch deployment for internet-facing Windows servers, remote access-adjacent systems, domain controllers, file servers, virtualization hosts, and administrative workstations.
• Use authenticated asset inventory to identify Windows 11 23H2, 24H2, 25H2, 26H1, Windows Server 2022, and Windows Server 2025 systems that have not received the relevant cumulative update.
• Temporarily restrict inbound network access to affected systems until patches are applied, especially from untrusted networks and broad internal segments.
• Increase monitoring for unexplained system crashes, bugchecks, endpoint protection tampering, suspicious service creation, credential dumping, and lateral movement originating from unpatched Windows hosts.
• Run targeted vulnerability scans after deployment and require reboot confirmation where applicable.
• Review exposure of Windows network services and remove unnecessary internet-facing access.
• Because the flaw is unauthenticated and network-accessible despite no current KEV listing, track threat intelligence and Microsoft advisories for exploit publication or emergency mitigation guidance.