Windows SMB Server CVE-2026-62790

Exploitation requires the attacker to hold at least low-privilege network credentials valid on the target system (PR:L per CVSS vector), confirming this is not an unauthenticated attack. The attacker must have network-level access to the SMB server on TCP port 445. The SMB Server service must be running and reachable - it is enabled by default on Windows Server editions and many Windows client configurations. No non-default feature flag or special configuration is required beyond the attacker possessing valid credentials. Exploitation is limited by: (1) the requirement for authenticated access, raising the bar above anonymous attackers; (2) network reachability to port 445, which many perimeter firewalls block externally; and (3) the need to target a specific unpatched build within the listed version ranges. Internal network attackers with any domain credentials face no additional prerequisites.

The CVSS 8.8 High score is well-supported by the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating full-triad impact with network reachability and low attack complexity. The primary limiting factor is PR:L - the attacker must be authenticated (hold at least low-privilege network credentials), which meaningfully reduces opportunistic mass exploitation risk compared to a PR:N flaw. However, in enterprise environments where SMB is broadly accessible and domain credentials are common (e.g., insider threats, phishing-compromised accounts, or credential-stuffing), this prerequisite is easily satisfied. No EPSS score was provided in the source intelligence, preventing probabilistic exploitation likelihood comparison. KEV status is not confirmed, meaning active exploitation in the wild has not been formally attested by CISA at time of analysis. No public proof-of-concept code was identified in the available data. Despite the absence of KEV or POC signals, the breadth of affected Windows versions - spanning over a decade of releases from Server 2012 to Server 2025 - means attack surface is enormous; even a mid-sized municipal IT team in koszalin running legacy Windows Server infrastructure would face meaningful exposure if patching is delayed. Organizations should treat this as a high-priority patching item, particularly for any environment where SMB is accessible to non-administrative users.

An attacker who has obtained low-privileged domain or local credentials - via phishing, credential stuffing, or lateral movement - connects to the SMB server on TCP port 445 and sends a specially crafted SMB request that triggers a heap buffer overflow in the server's message-processing code. The overflow overwrites adjacent heap metadata or function pointers, redirecting execution to attacker-controlled shellcode or ROP chain, resulting in arbitrary code execution at the privilege level of the SMB server process. No public proof-of-concept code was identified in the available intelligence at time of analysis.