EUVD-2026-44316
GHSA-q8r6-qhxq-g78g
Severity by source
AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent unauthenticated access with a timing-dependent race (AV:A/AC:H/PR:N); an origin-spoofing flaw primarily breaks integrity (I:H) with lesser confidentiality/availability effect, and scope changes across the NAT boundary (S:C).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network.
AnalysisAI
Spoofing via origin validation error in the Windows Network Address Translation (NAT) component affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, including Server Core installations. An unauthenticated attacker positioned on an adjacent network segment can bypass origin/authentication checks (CWE-346) to impersonate a trusted source, with Microsoft rating scope-changed high impact to confidentiality, integrity, and availability (CVSS 8.3). No public exploit identified at time of analysis, though high attack complexity limits reliable exploitation.
Technical ContextAI
Windows NAT (the Windows NAT driver, winnat, used by Hyper-V virtual switches, Internet Connection Sharing, WSL2, and Windows container networking) translates addresses between internal and external networks and must correctly validate the origin of network traffic to map responses to the correct internal host. The root cause is CWE-346 (Origin Validation Error): the NAT layer fails to properly verify that inbound packets genuinely originate from the expected/authorized source, allowing a spoofed peer on the same L2/adjacent network to be treated as legitimate. Per the CPE data the flaw is confined to newer platform builds - Windows 11 version 24H2, 25H2, and 26H1, and Windows Server 2025 (cpe:2.3:a:microsoft:windows_server_2025 and the Server Core installation) - implying the defect was introduced in or is specific to the current NAT stack in these releases rather than legacy Windows versions.
RemediationAI
Apply the Microsoft security update for CVE-2026-56181 from the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56181); patch is available per vendor, and the exact fixed build/KB numbers for each affected release should be taken directly from that advisory (specific build versions were not enumerated in the provided data, so do not assume a version number). Prioritize virtualization, container, ICS/RRAS, and WSL2 hosts where Windows NAT is actively in use. If patching must be delayed, reduce exposure by ensuring NAT-enabled Windows hosts do not share a broadcast/adjacent network segment with untrusted devices - segment them onto dedicated VLANs and apply switch-level protections (DHCP snooping, dynamic ARP inspection, port security) to make source spoofing on the adjacent link harder; where the NAT feature is not required, disabling Internet Connection Sharing or the Windows NAT (winnat) service removes the attack surface entirely, at the cost of breaking Hyper-V default-switch, container, and WSL2 outbound connectivity that depend on it.
More in Windows 11 Version 24H2
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today