CVE-2026-57089

What it actually does

CVE-2026-57089 is a use-after-free vulnerability in the Windows SMB Server Network Transport Driver, srvnet.sys. An unauthenticated remote attacker may be able to trigger unsafe reuse of freed kernel memory through crafted SMB network traffic, potentially leading to arbitrary code execution in kernel context. Successful exploitation could give the attacker high-impact control over confidentiality, integrity, and availability of the affected Windows host. The CVSS vector indicates network reachability, no privileges required, high impact, but high attack complexity and user interaction, meaning exploitation likely depends on specific timing, memory state, or target-side interaction conditions rather than a simple one-packet exploit.

Why it matters to the business

If exploited, this flaw could allow an attacker on a reachable network path to take control of affected Windows workstations or servers running SMB services. Operational consequences may include system compromise, lateral movement, deployment of malware, theft or manipulation of data, disruption of file sharing, and potential domain-wide impact if exploited against servers or administrator workstations. Although it is not currently listed in CISA KEV, has no known public exploit maturity, and has a low EPSS score of 0.0061, SMB vulnerabilities historically attract attacker interest because SMB is common in Windows environments and frequently exposed internally across enterprise networks.

How an attack unfolds

An attacker first identifies Windows systems exposing SMB services, typically on TCP port 445. They then determine whether the host is an affected Windows client or server version and whether the relevant security update is missing. Exploitation would involve sending specially crafted SMB traffic intended to trigger a use-after-free condition in srvnet.sys, influencing kernel memory reuse so execution flow can be redirected. If the exploit succeeds, attacker-controlled code may run with kernel-level privileges, enabling installation of malware, disabling security controls, credential access, or lateral movement. Because the vulnerability has high attack complexity and no public exploit maturity reported, reliable exploitation may require precise target conditions and may be less practical at scale than lower-complexity SMB flaws.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions: Windows 10 1607, 1809, 21H2, 22H2; Windows 11 24H2, 25H2, 26H1; Windows Server 2012, 2016, 2019, 2022, and 2025. No fixed build numbers were provided in the input, so use the applicable Microsoft cumulative update or security-only update for the July 2026 release cycle or later. Prioritize internet-facing SMB servers, file servers, domain controllers, virtualization hosts, backup servers, and administrator workstations. Where immediate patching is not possible, restrict SMB access to trusted networks only, block inbound TCP 445 from untrusted networks, disable SMB where not required, enforce host firewall rules, and monitor SMB traffic for abnormal behavior. Do not rely on SMB signing or authentication controls alone, because the flaw is described as reachable by an unauthorized network attacker.

How to confirm the fix worked

Confirm remediation by verifying that each affected host has installed the Microsoft cumulative or security update that includes the fix for CVE-2026-57089. Use enterprise patch management, Windows Update history, Microsoft Update Catalog applicability, or PowerShell-based inventory of installed hotfixes and build numbers. Validate that SMB exposure is reduced by confirming TCP port 445 is not reachable from untrusted networks and is limited to expected management and file-sharing segments. Perform authenticated vulnerability scans after patch deployment and confirm the scanner no longer reports the host as vulnerable. For compensating controls, test firewall rules from representative network locations and verify SMB remains available only where business-required.

Typical attack path

1. Scan internal or externally reachable address space for SMB exposure on TCP port 445.
2. Fingerprint Windows hosts and prioritize affected Windows client and server versions.
3. Check whether SMB is accessible without prior authentication and whether the target appears unpatched.
4. Send crafted SMB traffic designed to trigger the srvnet.sys use-after-free condition.
5. Achieve code execution in kernel context if memory manipulation succeeds.
6. Establish persistence, disable defenses, collect credentials, or move laterally to additional Windows systems.
7. Use compromised hosts to access file shares, administrative services, or other sensitive network resources.

How to detect it

To assess whether exploitation may have already occurred, collect and review Windows Event Logs, Microsoft-Windows-SMBServer operational logs, System logs, EDR telemetry, firewall logs, NetFlow, and network IDS records for abnormal SMB activity. Focus on hosts exposing TCP 445 that are unpatched or were patched late. Look for unusual inbound SMB traffic bursts, malformed SMB negotiation attempts, unexpected SMB sessions from non-standard clients, crashes or bugchecks involving srvnet.sys, unexpected reboots after SMB traffic, and suspicious activity immediately following SMB connections such as new services, driver loads, credential dumping tools, security control tampering, or lateral movement. Because no public exploit or unique exploit string is provided, detection should combine exposure, patch state, SMB traffic anomalies, kernel crash artifacts, and post-compromise indicators rather than relying on a single signature. Review memory dump metadata and Windows Error Reporting records for srvnet.sys involvement. If threat hunting finds SMB-triggered instability followed by privilege escalation, new persistence, or credential access, preserve disk, memory, and relevant logs for forensic analysis.

• srvnet.sys
• TCP/445
• Port 445
• Microsoft-Windows-SMBServer
• Microsoft-Windows-SMBServer/Operational
• SMBServer
• The computer has rebooted from a bugcheck
• Event ID 1001
• Event ID 6008
• Event ID 7031
• Event ID 7045
• BugCheck
• SYSTEM_SERVICE_EXCEPTION
• KMODE_EXCEPTION_NOT_HANDLED
• PAGE_FAULT_IN_NONPAGED_AREA
• IRQL_NOT_LESS_OR_EQUAL
• C:\Windows\System32\drivers\srvnet.sys
• C:\Windows\MEMORY.DMP
• C:\Windows\Minidump\

What your security team should do

• Prioritize patching of Windows servers and high-value workstations that expose SMB, especially domain controllers, file servers, backup infrastructure, and administrative endpoints.
• Block inbound SMB, especially TCP 445, from the internet and from network segments that do not require file-sharing access.
• Inventory all affected Windows versions and confirm they are receiving supported Microsoft security updates.
• Use vulnerability scanning and patch compliance reporting to identify systems missing the July 2026 or later Microsoft security update addressing this flaw.
• Review SMB exposure between user, server, production, backup, and management networks; remove unnecessary trust paths and lateral movement opportunities.
• Increase monitoring for unusual SMB connection patterns, crashes involving srvnet.sys, unexpected reboots, and suspicious post-exploitation activity on Windows hosts.
• Treat any unexplained kernel crash or instability on SMB-exposed systems as potentially security-relevant until patch state and logs are reviewed.
• Because there is currently no KEV listing, no ransomware attribution, low EPSS, and no known exploit maturity, prioritize based on SMB exposure and business criticality rather than emergency internet-wide exploitation assumptions.