CVE-2026-62816

This flaw is in a Windows networking driver (RMCAST) used for reliable multicast traffic. The bug is like a “mis-sized lock” in the driver: if an attacker can reach it from the network, they may be able to overwrite memory and run their own code.

If that happens, the attacker may gain control of the Windows machine, which can lead to data theft, ransomware, or disrupting business operations.

This matters if you run any of these on-prem systems: windows 10, windows 11, windows server 2012, windows server 2012 r2, windows server 2016, windows server 2019, windows server 2022, windows server 2025.

It’s a remote-code-execution issue tied to network access (“adjacent network”), so the risk is higher when untrusted devices can reach your internal network or you allow traffic paths where an attacker could contact the affected driver.

This is RED because it’s a remote code execution vulnerability in a core Windows networking driver and Microsoft has released fixes for multiple Windows versions. Security press attention specifically named Lazarus group, which raises the practical urgency even though there is no public exploit code recorded and CISA KEV does not list this CVE.

Act now to eliminate the vulnerable builds on any reachable systems—especially servers and workstations that sit on networks with potentially untrusted access paths.