RPC Endpoint Mapper CVE-2026-96300

The RPC Endpoint Mapper service (TCP port 135) must be network-reachable from the attacker; no authentication (PR:N) or user interaction (UI:N) is required. However, AC:H means exploitation is NOT a single-shot trigger against default settings - it requires conditions outside the attacker's full control, consistent with resource exhaustion that needs sustained or precisely-timed request volume to deplete service resources. Limiting factors: impact is availability-only (service outage, no data or integrity loss); port 135 is typically firewalled from the internet and exposed mainly on internal/enterprise networks, so realistic exposure is usually internal attackers or compromised internal hosts rather than the open internet.

This is a medium-severity availability-only flaw (CVSS 5.9) whose real-world priority is modest, and multiple independent signals agree on that. The CVSS vector (AV:N/PR:N/UI:N) confirms a network-reachable, unauthenticated trigger, but AC:H indicates the attacker does not fully control the conditions needed to succeed - typical of resource-exhaustion bugs (CWE-770) that require sustained or specifically-timed request patterns rather than a single packet. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed activity), Automatable=no, and Technical Impact=partial. No KEV listing and no public POC were provided, so exploitation status is speculative-at-best. EPSS is NOT present in the input and cannot be assessed - this is a gap, not a low score. Impact is strictly availability (C:N/I:N/A:H, Scope:Unchanged): no data disclosure, no code execution, no lateral movement. Net assessment: a patch-in-normal-cycle issue, not an emergency. The main thing that would elevate it is exposure of RPC Endpoint Mapper (TCP 135) directly to the internet, which is poor practice and uncommon in hardened environments.

A remote, unauthenticated attacker with network reachability to TCP port 135 sends a stream of crafted RPC Endpoint Mapper requests designed to consume server resources, eventually rendering the RPC locator/mapper service unresponsive and disrupting dependent services on the target Windows host. The AC:H rating implies this requires sustained or carefully-timed traffic rather than a single request, so it is a degradation/outage condition rather than instant takedown. No public exploit code was identified at time of analysis.