What is the CVSS score of EUVD-2026-44246?

EUVD-2026-44246 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Windows Server are affected by EUVD-2026-44246?

CVE-2026-56188 affects the entire Windows ecosystem-from desktop Windows 10/11 systems to critical Windows Server infrastructure running 2012-2025 versions-exposing organizations to unauthenticated…. A patch is available.

How to fix or mitigate EUVD-2026-44246?

Within 24 hours, IT operations must inventory all Windows 10, Windows 11, and Windows Server 2012-2025 systems to quantify organizational exposure and identify critical infrastructure dependencies. Over the next 7 days, validate Microsoft-released patches in isolated test environments to confirm compatibility with essential applications before production deployment. Within 30 days, execute a staged rollout beginning with non-critical systems, progressing to critical servers and domain controllers during scheduled maintenance windows, with comprehensive monitoring of deployment success and system stability.

Windows Server EUVD-2026-44246

| CVE-2026-56188 HIGH

Race Condition (CWE-362)

2026-07-14 microsoft

GHSA-fw6g-55xx-prrm

Authentication Bypass Race Condition Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

8.1

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

CRITICAL

qualitative

NVD

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.1 HIGH

Network-reachable driver flaw exploitable without auth or interaction (AV:N/PR:N/UI:N), but winning the race window makes AC:H; kernel code execution yields full C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 12:00 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 11:52 vuln.today

cvss_changed

Severity Changed

Jul 22, 2026 - 11:52 NVD

CRITICAL HIGH

CVSS changed

Jul 22, 2026 - 11:52 NVD

9.8 (CRITICAL) 8.1 (HIGH)

Analysis Generated

Jul 14, 2026 - 19:07 vuln.today

CVE Published

Jul 14, 2026 - 17:09 nvd

CRITICAL 9.8

DescriptionNVD

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in the Microsoft Windows network driver affects a broad range of Windows client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Windows Server 2025), where a race condition (CWE-362) in the shared network driver lets an unauthenticated network attacker who wins a timing window run arbitrary code with full system impact. Microsoft has shipped fixes and rates it 8.1 with high attack complexity; there is no public exploit identified at time of analysis and CISA SSVC lists exploitation status as none, though the flaw is assessed as automatable with total technical impact. The EPSS probability is low (1.00%, 59th percentile), consistent with the high-complexity, not-yet-exploited profile.

Technical ContextAI

The defect is a concurrency flaw (CWE-362, improper synchronization of a shared resource) in the Windows Server Network driver - a kernel-mode component that processes network traffic. Because multiple threads operate on shared driver state without adequate locking, an attacker who can precisely time overlapping network operations can drive the driver into an inconsistent state (e.g., use-after-free or state corruption) that is leveraged for code execution in the kernel/system context. The affected CPEs span microsoft:windows_10 (1607, 1809, 21H2, 22H2), windows_11 (24H2, 25H2, 26H1), and windows_server (2012, 2012 R2, 2016, 2019, 2022, 2025) including Server Core installations, indicating the vulnerable driver ships across the entire modern Windows codebase rather than a single edition. The 'Authentication Bypass' tag alongside CWE-362 suggests the race can be abused to reach code paths without completing normal authentication.

RemediationAI

Apply the Microsoft cumulative security update for the affected platform, which raises the OS build past the fixed threshold for each version - for example Windows Server 2025 to 10.0.26100.33158, Windows Server 2022 to 10.0.20348.5386, Windows Server 2019 to 10.0.17763.9020, Windows Server 2012 to 6.2.9200.26226, Windows 11 24H2 to 10.0.26100.8875, and Windows 10 22H2 to 10.0.19045.7548; consult the per-version build numbers in the MSRC advisory before deploying. Patch status: Patch available per vendor advisory (Vendor-released patch: build thresholds listed above from EUVD/MSRC data). Because the flaw is in a network-facing driver and is remotely reachable, prioritize internet-facing and DMZ Windows Servers first. Until patching completes, reduce exposure by restricting network reachability to the affected service at the perimeter and host firewall (limit the relevant SMB/network-driver ports to trusted management subnets), which trades off remote administrative and file-sharing access for reduced attack surface; segment legacy Server 2012/2012 R2 hosts that may lag on updates. Full remediation details are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56188.