CVE-2026-71331

This vulnerability is like a “crash-and-take-over” bug in how Windows’ attestation service processes specially crafted network messages. If someone can reach that service and trigger the bad input handling, they can run code on the server with very high privileges, which can lead to total compromise.

This matters if you run or expose Microsoft Azure Attestation / Windows Device Health Attestation services on Windows 10, Windows Server 2019, Windows Server 2022, or Windows Server 2025. Even though authentication and user interaction are not required, it still requires that an attacker can reach and successfully trigger the faulty processing path in the attestation service.

Put simply: it’s a risk primarily when those attestation components are reachable over the network from an attacker.

This is RED because it can lead to high-privilege remote code execution over the network, meaning a successful attack can fully compromise a machine. The tracking information also indicates this is associated with a serious threat actor, and the main control available is to apply the official fixes.