CVE-2026-57092
A critical flaw in Windows VMSwitch lets an attacker who can already access a system over the network gain higher privileges. The bug is a use‑after‑free that can be triggered by a malicious network packet, potentially allowing the attacker to take full control of the affected machine.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (24H2, 25H2, 26H1) – all listed CPEs.
Real-world impact
An attacker who can send crafted packets to the VMSwitch service could elevate privileges, potentially taking full control of the host and compromising other network resources.
Why this severity
The CVSS score of 9.9 reflects that the vulnerability is network‑reachable, requires low effort, and gives an attacker full control over confidentiality, integrity, and availability. The vector shows it can be exploited remotely with minimal privileges and no user interaction.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 14, 2026 · 20d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…patchvendor advisory