Windows SMB Server CVE-2026-57089

No special conditions beyond network reachability to the SMB Server: the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote, unauthenticated exploitation with no user interaction against default configurations where SMB Server (srvnet.sys / LanmanServer) is running and listening on TCP/445 - the default on Windows Server roles and many clients. What limits exploitation in practice: the target must expose port 445 to the attacker (commonly blocked at the internet edge but open on internal LANs), the LanmanServer/SMB Server service must be enabled, and reliable code execution requires successful kernel heap grooming and mitigation bypass - reflected in CISA SSVC rating the flaw 'Automatable: no' despite the low-complexity CVSS metric.

The signals are partially conflicting and warrant nuance. CVSS 9.8 with AV:N/AC:L/PR:N/UI:N indicates trivial, unauthenticated, network-reachable exploitation with total confidentiality/integrity/availability impact, and CISA SSVC rates Technical Impact as 'total' - consistent with kernel RCE. However, SSVC also marks Exploitation as 'none' and Automatable as 'no', and EPSS is only 0.57% (43rd percentile), suggesting no observed in-the-wild activity and that reliable exploitation of a kernel use-after-free is non-trivial (heap grooming, timing, and mitigation bypass are required). The 'Automatable: no' rating tempers the wormable narrative that AC:L alone would imply. Net assessment: this is a genuine high-priority patch target given the enormous install base and pre-auth kernel RCE potential, but the low EPSS and 'none' exploitation status indicate it is not yet under active exploitation - treat as urgent-to-patch rather than emergency-in-progress. Worth flagging: AC:L implies low attack complexity, yet UAF exploitation is typically complex, which is likely why SSVC judged it non-automatable.

An attacker with network reachability to TCP/445 sends a crafted sequence of SMB packets that drives srvnet.sys into referencing freed kernel pool memory, then grooms the heap so the reused allocation contains attacker-controlled data, achieving code execution as SYSTEM without any credentials or user interaction. In a flat internal network or an internet-exposed SMB host, this could allow initial access or lateral movement from a single unauthenticated connection. No public exploit code was identified at time of analysis, and reliable weaponization of the use-after-free would require nontrivial kernel heap manipulation.