What is the CVSS score of EUVD-2026-44020?

EUVD-2026-44020 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Windows TCP/IP are affected by EUVD-2026-44020?

A critical vulnerability in Windows TCP/IP networking (CVE-2026-54999, CVSS 8.8) affects all Windows 10, Windows 11, and Windows Server versions in use today, allowing network-adjacent attackers to…. A patch is available.

How to fix or mitigate EUVD-2026-44020?

Within 24 hours, conduct an inventory of Windows systems in your environment to identify those running Windows 10 (1607 through current), Windows 11 (all versions through 26H1), or Windows Server 2012 through 2025, and categorize by business criticality. Within 7 days, deploy Microsoft's patch for CVE-2026-54999 to all production servers and critical infrastructure systems, beginning with domain controllers and leveraging Windows Update or your patch management solution. Within 30 days, complete patch deployment to the entire Windows estate including all desktops, verify deployment status across your organization, and implement network monitoring for exploitation attempts; for any systems that cannot be immediately patched due to compatibility constraints, establish network segmentation and access controls as interim protection.

Windows TCP/IP EUVD-2026-44020

| CVE-2026-54999 HIGH

Race Condition (CWE-362)

2026-07-14 microsoft

GHSA-pr9w-vppj-jx9w

Authentication Bypass Race Condition Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Adjacent-network unauthenticated RCE with full impact, but AC:H because winning the CWE-362 race window requires precise timing and repeated attempts.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:01 vuln.today

CVE Published

Jul 14, 2026 - 17:04 nvd

HIGH 8.8

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network.

AnalysisAI

Remote code execution in the Microsoft Windows TCP/IP networking stack allows an unauthenticated attacker on the same physical or logical network segment to win a race condition and run arbitrary code on the target. The flaw spans a broad range of desktop and server builds from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. There is no public exploit identified at time of analysis, but Microsoft has confirmed the issue and shipped a patch, and the high CVSS (8.8) plus network-facing kernel component make it a priority to remediate.

Technical ContextAI

The vulnerable component is the Windows TCP/IP driver (tcpip.sys), the kernel-mode implementation of the IPv4/IPv6 protocol stack that processes every inbound packet. The root cause is CWE-362, a race condition: concurrent execution paths operate on a shared resource without proper synchronization, so an attacker who can precisely time packets can drive the stack into an inconsistent state that corrupts kernel memory and leads to code execution. Because this logic lives in the kernel and handles untrusted network input before any authentication layer, successful exploitation yields execution in a highly privileged context. The affected CPEs enumerate Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server editions from 2012 (including Server Core) through 2025.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update for your specific Windows/Windows Server build as listed in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54999); the exact fixed KB/build number is not reproduced in the input data, so pull it per-edition from the advisory. Because the attack is adjacent-network only, the most effective compensating control until patching is network segmentation: isolate unpatched hosts on their own VLAN, restrict which peers share their link, and enforce 802.1X/port security so untrusted devices cannot join the segment - the trade-off is added network-management overhead and possible disruption to same-subnet services such as file sharing and discovery. Blocking or rate-limiting affected traffic at host firewalls can raise the bar but may break legitimate connectivity, so test before broad deployment. Prioritize internet-adjacent and shared-LAN servers, especially Server Core and 2012-era systems, first.