Windows NC Host Agent EUVD-2026-35746

Exploitation requires local authenticated access to the target Windows Server system with at minimum a low-privileged account (confirmed by CVSS PR:L). The NC Host Agent service must be running, which is only the case on Windows Server systems participating in a Microsoft Software Defined Networking (SDN) deployment with a Network Controller fabric - this is a non-default, enterprise datacenter configuration. Exploitation is limited to denial of service against service availability only; no privilege escalation or data access is possible via this vulnerability. Remote or unauthenticated exploitation is ruled out by the local attack vector (AV:L). The scope is unconstrained within the service (S:U), meaning the crash is confined to the NC Host Agent process and does not directly pivot to the OS or other services.

The CVSS score of 5.5 (Medium) accurately reflects a constrained threat profile: attack vector is local (AV:L), meaning remote exploitation is not possible without prior foothold, and privileges required are low (PR:L), meaning a standard Windows account suffices but unauthenticated remote exploitation is ruled out. The impact is limited entirely to availability (C:N/I:N/A:H), so data exfiltration or tampering are not in scope. No EPSS data was provided in source intelligence, and no CISA KEV listing exists, indicating no confirmed in-the-wild exploitation. No public POC has been identified. Real-world risk is therefore elevated primarily in environments where the NC Host Agent is actively running as part of an SDN deployment, and where insider threat or post-compromise lateral movement scenarios are relevant. For organizations not using Windows Server SDN/Network Controller features, the attack surface is effectively nil.

A locally authenticated user on a Windows Server system running the NC Host Agent - for example, a low-privileged service account or a compromised interactive session - sends a crafted request or triggers a specific code path in the NC Host Agent that dereferences a freed memory region, causing the service to crash and disrupting SDN network controller communications for that host. No public POC exists, so exploitation currently requires independent vulnerability research or knowledge of the specific freed object and trigger sequence.