EUVD-2026-29629
GHSA-x2h2-hw5m-3qwq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network reachable with low complexity; PR:L reflects 'authorized attacker' prerequisite; integrity-only impact matches security feature bypass with no data disclosure or service disruption.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feature over a network.
AnalysisAI
Windows TCP/IP stack allows a low-privilege network-authenticated attacker to bypass a security feature by exploiting an alternate path or channel (CWE-288), resulting in a high-integrity impact without requiring user interaction. Affected scope spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2012 through Server 2025, making the exposure footprint extremely broad. No public exploit code exists and no active exploitation is confirmed at time of analysis; EPSS at 0.06% (18th percentile) and SSVC classification of 'exploitation: none, automatable: no' indicate low near-term weaponization risk despite the wide attack surface.
Technical ContextAI
CWE-288 describes a weakness where authentication or authorization is enforced on one path to a resource but an alternate path or channel exists that bypasses those controls entirely. In the context of the Windows TCP/IP stack, this suggests a security enforcement mechanism - likely a packet-filter, connection-gating, or protocol-level access control layer - can be circumvented by routing traffic through an unprotected channel or crafting packets that trigger the unguarded code path. CPE data confirms the vulnerability is present across the application-layer Windows networking components from legacy Windows Server 2012 (kernel 6.2.9200) through the latest Windows Server 2025 and Windows 11 26H1 (kernel 10.0.28000). The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U reflects that exploitation is network-reachable, requires no attack complexity, but does demand that the attacker hold at least low-level authorization, consistent with the description's reference to 'an authorized attacker.'
RemediationAI
Apply the Microsoft security updates released for this vulnerability, available via Windows Update, WSUS, or the Microsoft Update Catalog as referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35422. Specific fix build targets confirmed from EUVD data include: Windows 11 24H2 to 10.0.26100.8457, Windows 11 25H2 to 10.0.26200.8457, Windows 11 26H1 to 10.0.28000.2113, Windows Server 2025 to 10.0.26100.32860, Windows Server 2022 to 10.0.20348.5139, Windows Server 2019 to 10.0.17763.8755, and Windows Server 2016 to 10.0.14393.9140, among others listed above. For legacy systems such as Windows Server 2012 and 2012 R2, which are beyond mainstream support, verify Extended Security Update (ESU) eligibility before applying patches. As a compensating control where immediate patching is not possible, restricting network access to Windows systems from untrusted or unprivileged principals via host-based firewall rules or network segmentation can reduce the attack surface, though this does not eliminate the underlying vulnerability and must be tailored to operational requirements. Prioritize patching in environments where low-privilege network accounts exist (e.g., domain-joined systems, VPN endpoints, or shared infrastructure).
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today