EUVD-2026-29629
GHSA-x2h2-hw5m-3qwq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network reachable with low complexity; PR:L reflects 'authorized attacker' prerequisite; integrity-only impact matches security feature bypass with no data disclosure or service disruption.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feature over a network.
AnalysisAI
Windows TCP/IP stack allows a low-privilege network-authenticated attacker to bypass a security feature by exploiting an alternate path or channel (CWE-288), resulting in a high-integrity impact without requiring user interaction. Affected scope spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2012 through Server 2025, making the exposure footprint extremely broad. No public exploit code exists and no active exploitation is confirmed at time of analysis; EPSS at 0.06% (18th percentile) and SSVC classification of 'exploitation: none, automatable: no' indicate low near-term weaponization risk despite the wide attack surface.
Technical ContextAI
CWE-288 describes a weakness where authentication or authorization is enforced on one path to a resource but an alternate path or channel exists that bypasses those controls entirely. In the context of the Windows TCP/IP stack, this suggests a security enforcement mechanism - likely a packet-filter, connection-gating, or protocol-level access control layer - can be circumvented by routing traffic through an unprotected channel or crafting packets that trigger the unguarded code path. CPE data confirms the vulnerability is present across the application-layer Windows networking components from legacy Windows Server 2012 (kernel 6.2.9200) through the latest Windows Server 2025 and Windows 11 26H1 (kernel 10.0.28000). The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U reflects that exploitation is network-reachable, requires no attack complexity, but does demand that the attacker hold at least low-level authorization, consistent with the description's reference to 'an authorized attacker.'
RemediationAI
Apply the Microsoft security updates released for this vulnerability, available via Windows Update, WSUS, or the Microsoft Update Catalog as referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35422. Specific fix build targets confirmed from EUVD data include: Windows 11 24H2 to 10.0.26100.8457, Windows 11 25H2 to 10.0.26200.8457, Windows 11 26H1 to 10.0.28000.2113, Windows Server 2025 to 10.0.26100.32860, Windows Server 2022 to 10.0.20348.5139, Windows Server 2019 to 10.0.17763.8755, and Windows Server 2016 to 10.0.14393.9140, among others listed above. For legacy systems such as Windows Server 2012 and 2012 R2, which are beyond mainstream support, verify Extended Security Update (ESU) eligibility before applying patches. As a compensating control where immediate patching is not possible, restricting network access to Windows systems from untrusted or unprivileged principals via host-based firewall rules or network segmentation can reduce the attack surface, though this does not eliminate the underlying vulnerability and must be tailored to operational requirements. Prioritize patching in environments where low-privilege network accounts exist (e.g., domain-joined systems, VPN endpoints, or shared infrastructure).
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today