CVE-2026-56188
A race condition in the Windows Server Network driver allows an unauthenticated attacker to execute arbitrary code over the network. The vulnerability is rated critical with a CVSS score of 9.8 and affects multiple editions of Windows 10, Windows 11, and Windows Server. No official fix or known exploitation is documented in the provided sources.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 24H2, 25H2, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025.
Real-world impact
An attacker could gain full control of affected systems remotely, leading to data theft, further malware deployment, or disruption of services.
Why this severity
The CVSS v3.1 score of 9.8 reflects a network‑adjacent attack with low complexity, no privileges or user interaction required, and high impacts to confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 14, 2026 · 20d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…patchvendor advisory