Windows TCP/IP CVE-2026-54999

The attacker must have adjacent-network access (AV:A) - a position on the same physical/logical link, LAN, or VLAN as the target - and cannot exploit this across a routed internet path. No authentication and no user interaction are required (PR:N/UI:N), so any unauthenticated host on that segment can attempt it against default Windows configurations with the TCP/IP stack active, i.e. any networked Windows host. The principal limiting factor is the timing-dependent nature of the race condition: the attacker must reliably win a synchronization window, which typically demands many attempts and favorable network conditions, making reliable exploitation harder than the AC:L rating suggests. Restricting who can reach the target's network segment therefore directly constrains real-world exploitability.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes an adjacent-network, low-complexity, unauthenticated attack with full confidentiality, integrity, and availability impact - a serious profile for a kernel network component. The AV:A constraint is the main mitigating factor: the attacker must be on the same broadcast/logical segment (same LAN, VLAN, or link) rather than routing across the internet, which limits mass exploitation. No EPSS score, SSVC decision, or KEV entry was provided, so exploitation probability cannot be quantified and there is no evidence of active exploitation. Note a conflict worth verifying: race-condition bugs typically require winning a timing window (arguing for AC:H), yet the supplied vector rates AC:L - treat the 'low complexity' rating with caution, as reliable exploitation may be harder than the score implies. The 'Authentication Bypass' tag is inconsistent with a TCP/IP RCE described purely as a race condition and is not corroborated by the description, so do not rely on it.

An attacker who has gained a foothold on a device in the same LAN segment - for example a compromised workstation, a rogue device on an open Ethernet port, or a machine on the same VLAN - sends a carefully timed sequence of crafted packets to a target's TCP/IP stack. By repeatedly racing the vulnerable synchronization window, the attacker corrupts kernel memory and executes code with kernel privileges, requiring no credentials or user interaction. No public exploit is identified at time of analysis, so this remains a plausible but not yet demonstrated attack.