What is the CVSS score of CVE-2026-42974?

CVE-2026-42974 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows Performance Monitor are affected by CVE-2026-42974?

Microsoft Windows Performance Monitor is vulnerable to remote code execution (CVE-2026-42974, CVSS 8.1), allowing unauthenticated network attackers to execute arbitrary code on monitoring…. A patch is available.

How to fix or mitigate CVE-2026-42974?

Within 24 hours: Identify all Windows systems running Performance Monitor and assess which are exposed to untrusted networks. Within 7 days: Apply the Microsoft MSRC-released patch for CVE-2026-42974 via Windows Update or WSUS to all affected systems. Within 30 days: Verify patch deployment across the environment and monitor Windows Event Logs and network traffic for exploitation attempts.

Windows Performance Monitor CVE-2026-42974

EUVD-2026-35736 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-06-09 secure@microsoft.com

GHSA-j6cc-qpjj-g659

Authentication Bypass Integer Overflow Microsoft Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2022 Windows Server 2025

8.1

CVSS 3.1 · Vendor: microsoft

Temporal: 7.1

Severity by source

Vendor (microsoft) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.1 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:38 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 8.1

DescriptionCVE.org

Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Windows Performance Monitor (PerfMon) allows unauthenticated network-based attackers to execute arbitrary code by triggering an integer underflow condition. The flaw carries a CVSS 3.1 score of 8.1 driven by high impact across confidentiality, integrity, and availability, though high attack complexity (AC:H) tempers exploitability. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but Microsoft has released a patch via MSRC guidance.

Technical ContextAI

Windows Performance Monitor (PerfMon) is a built-in Windows management tool that collects, displays, and logs system performance counter data from local and remote machines, communicating across networks via RPC and related Windows performance counter APIs. The root cause is CWE-190 (Integer Overflow or Wraparound) - specifically an integer underflow where a subtraction or decrement operation produces a value below the representable minimum, wrapping to a large unsigned value. When that wrapped value is subsequently used as a size or offset in memory operations, it can corrupt heap metadata or adjacent buffers, enabling control of execution flow. The 'Authentication Bypass' tag combined with PR:N implies the vulnerable code path is reachable before normal authentication completes on the network-facing PerfMon component.

RemediationAI

Apply the patch available per Microsoft's vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42974 through the relevant monthly Windows security update for each affected Windows edition; the exact KB article numbers should be retrieved from the MSRC guide for the specific Windows build in use. As compensating controls until patching completes, block inbound TCP/445 and dynamic RPC endpoint mapper traffic (TCP/135 and the high-port range) from untrusted networks at the host or perimeter firewall to remove the network attack surface, with the trade-off that legitimate remote management and file-sharing workflows will break. Disabling or restricting the Performance Logs and Alerts service and the Remote Registry service on hosts that do not require remote performance counter collection further reduces the reachable code path, though this will prevent centralized monitoring tools from polling those hosts.