Windows NLB EUVD-2026-99392

Exploitation requires the target Windows Server host to have the Network Load Balancing (NLB) feature installed and enabled and to be reachable on the network interface NLB listens on; NLB is not part of a default Windows Server installation, which is the primary factor limiting real-world exposure. Where NLB is active, the CVSS vector indicates no authentication and no user interaction are needed (PR:N/UI:N). Affected builds span Windows Server 2012 through 2025 (including Server Core) and Windows 10 1607/1809, each fixed in the build ranges listed in the EUVD data; hosts patched to the fixed build are not exploitable.

All severity signals point to a critical, pre-authentication remote code execution issue: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with total impact (C:H/I:H/A:H, 9.8), and the CISA SSVC framework corroborates this with Technical Impact 'total' and Automatable 'yes' - meaning a reliable exploit could be scripted and scaled. However, the signals are not uniformly alarming: SSVC Exploitation is 'none', there is no CISA KEV listing, and no public exploit was identified, so current real-world exploitation pressure is low. No EPSS score was provided in the input, so the statistical exploitation-probability signal is missing and cannot be weighed. The single most important risk-tempering factor is that Windows Network Load Balancing is an optional clustering feature that is not installed or enabled by default, so despite PR:N the exploitable surface is confined to hosts where NLB is actively running - this makes the issue a high-priority patch for NLB cluster operators but a materially lower practical risk for the general Windows Server population. Net: a genuine priority for exposed NLB clusters, but the absence of known exploitation and the non-default feature requirement argue against treating it as an active mass-exploitation emergency today.

An unauthenticated attacker who can reach a Windows Server host running the Network Load Balancing feature sends specially crafted traffic that triggers a use-after-free in the NLB component, corrupting memory to achieve remote code execution with high privileges. Because the flaw is network-reachable with low complexity and no user interaction (AV:N/AC:L/UI:N), a successful exploit could be automated across reachable NLB nodes (SSVC Automatable: yes). No public exploit code has been identified at time of analysis.