Which versions of Microsoft are affected by CVE-2026-3787?

A HIGH severity vulnerability in UltraVNC 1.6.4.0 affects Windows systems and could allow unauthorized access or privilege escalation through the cryptbase.dll component.

How to fix or mitigate CVE-2026-3787?

Within 24 hours: Identify all systems running UltraVNC 1.6.4.0 and assess business criticality; disable UltraVNC on non-essential systems immediately. Within 7 days: Implement network segmentation to restrict UltraVNC traffic to authorized administrative networks only; enable Enhanced Session Mode and enforce strong authentication if UltraVNC remains enabled. Within 30 days: Develop a migration plan to alternative remote access solutions (consider RDP with MFA, TeamViewer, or commercial VPN solutions); monitor RealVNC announcements for patch availability and test in non-production environment upon release.

Microsoft CVE-2026-3787

Q: What is the CVSS score of CVE-2026-3787?

CVE-2026-3787 has a CVSS 4.0 base score of 6.4 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Untrusted Search Path (CWE-426)

2026-03-08 cna@vuldb.com

Information Disclosure Microsoft

6.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.0 (HIGH) 6.4 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 08, 2026 - 23:15 nvd

HIGH 7.0

DescriptionCVE.org

A weakness has been identified in UltraVNC 1.6.4.0 on Windows. This affects an unknown function in the library cryptbase.dll of the component Windows Service. This manipulation causes uncontrolled search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

UltraVNC 1.6.4.0 on Windows contains an uncontrolled search path vulnerability in cryptbase.dll that allows local authenticated attackers with low privileges to achieve arbitrary code execution through DLL hijacking. Successful exploitation requires local access and considerable technical complexity, though the vendor has not provided a patch despite early disclosure notification. This vulnerability carries a high impact rating with potential for complete system compromise (confidentiality, integrity, and availability).

Technical ContextAI

Classified as CWE-426 (Untrusted Search Path). Affects the library cryptbase.dll of the component of Ultravnc. A weakness has been identified in UltraVNC 1.6.4.0 on Windows. This affects an unknown function in the library cryptbase.dll of the component Windows Service. This manipulation causes uncontrolled search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.