Windows TCP/IP CVE-2026-35422

Exploitation requires that the attacker hold at least low-level authorization on the network - described explicitly in the CVE as 'an authorized attacker,' and reflected in CVSS PR:L. This rules out anonymous or fully unauthenticated exploitation. The bypass occurs over the network (AV:N, AC:L), meaning no local or physical access is required, and no user interaction is needed (UI:N). The specific security feature being bypassed is not named in the available data, but the CWE-288 class and 'Windows TCP/IP' component suggest it involves a network-facing control enforced within the TCP/IP stack. Limiting factors: the attacker must already possess valid credentials or an authorized network session; SSVC confirms the attack is not automatable, implying environment- or target-specific conditions must be met per exploitation attempt. No special non-default configuration is identified as required from available data, but the precise triggering condition (e.g., a specific protocol, port, or service binding) is not disclosed.

CVSS 6.5 (Medium) with PR:L indicates the attacker must already be authenticated or authorized on the network, which is a meaningful barrier that tempers the effective risk relative to the I:H integrity impact. EPSS of 0.06% at the 18th percentile is exceptionally low, suggesting virtually no observed or modeled exploit activity in the wild. SSVC corroborates this: exploitation status 'none,' not automatable, and only partial technical impact. This is not in the CISA KEV catalog, and no POC has been identified. The principal real-world risk driver is the sheer breadth of the affected product surface - virtually every Windows deployment - meaning even a low exploitation probability translates to potential scale if a POC emerges. However, the PR:L prerequisite means mass-automated exploitation is unlikely without a privilege escalation chain. Current signals point to this as a lower-priority patch item compared to unauthenticated or KEV-listed vulnerabilities, but organizations with externally accessible Windows services or multi-tenant environments should prioritize patching given the integrity impact.

An attacker with low-level network credentials - such as a domain user or VPN-authenticated user - crafts TCP/IP packets that route through an alternate, unguarded code path in the Windows networking stack, bypassing a security enforcement mechanism (such as a firewall rule or protocol-level access gate) that would otherwise block the traffic. No public exploit code has been identified, so this scenario currently requires bespoke development of the exploit technique. The SSVC assessment of 'not automatable' suggests that reliable mass exploitation without per-target adaptation is unlikely at this stage.