EUVD-2026-44316
GHSA-q8r6-qhxq-g78g
Severity by source
AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent unauthenticated access with a timing-dependent race (AV:A/AC:H/PR:N); an origin-spoofing flaw primarily breaks integrity (I:H) with lesser confidentiality/availability effect, and scope changes across the NAT boundary (S:C).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network.
AnalysisAI
Spoofing via origin validation error in the Windows Network Address Translation (NAT) component affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, including Server Core installations. An unauthenticated attacker positioned on an adjacent network segment can bypass origin/authentication checks (CWE-346) to impersonate a trusted source, with Microsoft rating scope-changed high impact to confidentiality, integrity, and availability (CVSS 8.3). No public exploit identified at time of analysis, though high attack complexity limits reliable exploitation.
Technical ContextAI
Windows NAT (the Windows NAT driver, winnat, used by Hyper-V virtual switches, Internet Connection Sharing, WSL2, and Windows container networking) translates addresses between internal and external networks and must correctly validate the origin of network traffic to map responses to the correct internal host. The root cause is CWE-346 (Origin Validation Error): the NAT layer fails to properly verify that inbound packets genuinely originate from the expected/authorized source, allowing a spoofed peer on the same L2/adjacent network to be treated as legitimate. Per the CPE data the flaw is confined to newer platform builds - Windows 11 version 24H2, 25H2, and 26H1, and Windows Server 2025 (cpe:2.3:a:microsoft:windows_server_2025 and the Server Core installation) - implying the defect was introduced in or is specific to the current NAT stack in these releases rather than legacy Windows versions.
RemediationAI
Apply the Microsoft security update for CVE-2026-56181 from the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56181); patch is available per vendor, and the exact fixed build/KB numbers for each affected release should be taken directly from that advisory (specific build versions were not enumerated in the provided data, so do not assume a version number). Prioritize virtualization, container, ICS/RRAS, and WSL2 hosts where Windows NAT is actively in use. If patching must be delayed, reduce exposure by ensuring NAT-enabled Windows hosts do not share a broadcast/adjacent network segment with untrusted devices - segment them onto dedicated VLANs and apply switch-level protections (DHCP snooping, dynamic ARP inspection, port security) to make source spoofing on the adjacent link harder; where the NAT feature is not required, disabling Internet Connection Sharing or the Windows NAT (winnat) service removes the attack surface entirely, at the cost of breaking Hyper-V default-switch, container, and WSL2 outbound connectivity that depend on it.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today