CVE-2026-42904

This flaw is in Windows’ networking software (TCP/IP). If an attacker can reach the machine over the network, they may be able to use a specially crafted network input to gain higher privileges—like stepping from a limited position into full control.

This matters if you run Windows 10, Windows 11, or Windows Server (including Server 2012/2012 R2/2016/2019/2022/2025). Because this is an elevation-of-privilege issue in TCP/IP, it is primarily a risk when an attacker can reach your device over the network. Exploitability depends on whether the vulnerable network-facing path is reachable; patching is the key way to close the door.

Verdict is RED: this is a critical elevation-of-privilege flaw in core Windows networking, and fixes are available for many widely used Windows builds. Even without public exploit code on record and without confirmed KEV listing, the impact is severe because a successful attacker could gain administrator-level capabilities from network access. Act on patching as a top priority.

1. Inventory and scope

• Identify all endpoints and servers running: Windows 10, Windows 11, and Windows Server 2012/2012 R2/2016/2019/2022/2025.
• Include any special Windows 11 variant noted in your environment (the listing includes “Windows 11 26H1 - extra”).

2. Check whether systems are already fixed

• For each system, determine its current OS build number.
• Compare to the vendor’s fixed builds:
  • Windows 10: fixed in 10.0.19044.7417 and 10.0.19045.7417
  • Windows 11: fixed in 10.0.22631.7219; 10.0.26100.8655; 10.0.26200.8655; 10.0.28000.2269
  • Windows Server 2022: fixed in 10.0.20348.5256
  • Windows Server 2025: fixed in 10.0.26100.32995
• If a system is below the fixed build for its branch, it is still at risk.

3. Apply the fix

• Install Microsoft’s security update for CVE-2026-42904 using your normal Windows Update or update management process.
• Reboot when required so the updated components are active.

4. Temporary workaround if patching is delayed

• Reduce network exposure to the affected hosts by limiting inbound access (for example, restrict which subnets can reach them).
• Ensure only necessary services/ports are reachable from untrusted networks.
  (These steps reduce reachability; they do not replace patching.)

5. Verification

• After updating and rebooting, re-check the OS build number to confirm it meets or exceeds the fixed version for the relevant branch.
• Confirm no installation errors were reported by your update tooling.

6. Monitoring

• Since this is a privilege escalation path in TCP/IP, monitor for signs of post-exploitation on hosts (new privileged accounts, unexpected admin activity, or suspicious process launches), and review network logs for unusual inbound patterns around the time of any updates.

CISA KEV

• Not listed in CISA KEV (per available findings), so rely on patch status rather than KEV membership.

CVE-2026-42904 is a Windows TCP/IP vulnerability involving a heap-based buffer overflow. The weakness type is CWE-122, which is commonly associated with memory corruption that can be leveraged for control-flow or privilege changes.

Exploitation status

• No public exploit code is on record.
• Not listed in CISA KEV.
• Publicly available KEV/exploitation confirmation is not provided in the findings.

Risk framing

• Predicted likelihood (EPSS) is reported as 0.4% with a flat trend, but the overall urgency here is driven by the critical impact (elevation of privilege) and the availability of fixes across many core Windows versions.

What “KEV not listed” means here

• KEV would indicate confirmed exploitation/in the wild tracking. Since it’s not listed, confirmed mass exploitation is not evidenced in the provided findings, but the vulnerability is still critical and the vendor has shipped fixes.

Attack vector (from the scenario described)

• Network-reachable trigger via Windows TCP/IP, allowing an unauthorized attacker to elevate privileges over an adjacent network.