EUVD-2026-99887
GHSA-3hg3-pwxv-ppq3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted input to target host
-
DeliveryInduce user interaction (UI:R)
-
ExploitTrigger use-after-free in Storport miniport driver
-
ExecutionCorrupt freed kernel object
-
ImpactExecute code at kernel privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Affects Windows Server 2025 (including Server Core) at builds 10.0.26100.0 through below 10.0.26100.33650; hosts patched to 10.0.26100.33650 or later are not vulnerable. Per CVSS PR:N, no authentication is required, but UI:R means successful exploitation requires a user on the host to perform an action that reaches the vulnerable Storport Miniport Driver code path - this interaction requirement is the primary limiting factor and is consistent with SSVC Automatable=no. The description does not name the specific network-facing feature, protocol, or configuration that carries the use-after-free trigger into this storage-stack kernel driver, so the concrete delivery prerequisite cannot be stated from the available data and should be confirmed via the Microsoft MSRC advisory. |
| Impact | Signals are moderately consistent but point to a conditional rather than wormable threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) scores 8.8 HIGH: low complexity, no privileges, but mandatory user interaction, and total CIA impact (C:H/I:H/A:H) consistent with kernel-level code execution in a storage driver. CISA SSVC counters the urgency: Exploitation=none (no observed activity), Automatable=no (consistent with the UI:R requirement defeating mass automation), yet Technical Impact=total. No EPSS score and no KEV listing are provided, and no POC is referenced, so there is no evidence of imminent or widespread exploitation. One notable inconsistency: the CVSS declares a network attack vector (AV:N) for the Windows Storport Miniport Driver - a storage-stack kernel component - and the description says 'execute code over a network,' but the description gives no network-facing feature or protocol that would carry the UAF trigger; the realistic delivery path is not spelled out and should be verified against the Microsoft MSRC advisory. Also note the Tags list 'Denial Of Service' while both the description and SSVC indicate total impact / code execution, suggesting the tag understates severity. Net: a genuinely serious patch-worthy flaw (kernel RCE, patch available) but currently a managed-patch priority, not an emergency, given no exploitation evidence and a user-interaction gate. |
| Exploit ScenarioDerived | An unauthenticated attacker lures a user on an affected Windows Server 2025 host into an action that reaches the vulnerable Storport miniport code path, triggering the use-after-free to corrupt kernel memory and execute attacker-controlled code at driver privilege. No public exploit is identified at time of analysis, and the user-interaction requirement (UI:R) means the victim must be induced to perform some action rather than the host being hit passively. The exact network-facing trigger is not described, so a working chain would depend on details not present in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Use-after-free in the Windows Storport Miniport Driver (storport.sys) on Windows Server 2025, including Server Core installations, allows remote attackers to corrupt kernel memory and potentially execute code in the kernel after a user on the host performs an action that reaches the vulnerable driver code path. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R), no authentication is needed but successful exploitation is conditional on user interaction, which is the primary limiting factor and is consistent with the SSVC assessment of Automatable=no; the specific network-facing feature or protocol that carries the trigger into this storage-stack driver is not named in the available data and should be confirmed against the Microsoft MSRC advisory. A vendor patch is available and hosts at build 10.0.26100.33650 or later are not vulnerable; no public exploit code and no confirmed active exploitation have been identified at time of analysis. Overall, signals are moderately consistent but point to a conditional rather than wormable threat, with technical impact assessed as total if the use-after-free is successfully triggered.
RemediationAI
Vendor-released patch: update Windows Server 2025 (including Server Core) to build 10.0.26100.33650 or later, applied through the standard Microsoft update channel as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69765; hosts at or above that build are not vulnerable, so patch-level verification against 10.0.26100.33650 is the simplest confirmation of remediation. If immediate patching is not possible, note that exploitation requires a user on the host to perform an action that reaches the vulnerable Storport code path (UI:R) and that no authentication is required (PR:N), so the practical compensating control is to shrink the interactive attack surface of the storage host: restrict and audit who can log on locally or via RDP/console sessions to affected servers, apply least-privilege so that only trusted administrators can interact with the host, and limit exposure of any remote management or file/I/O paths that terminate on the server, accepting that this reduces operational flexibility for administrators and does not address an unauthenticated network trigger if one is confirmed in the advisory. Monitor system and storage event logs and crash dumps for bugchecks pointing at storport.sys as an indicator that the use-after-free has been reached, and re-check the MSRC advisory for clarification of the precise network-facing feature, protocol or configuration that carries the trigger, since the delivery prerequisite is not established by the available data. No public exploit code has been identified at time of analysis, so there is no confirmed need for emergency network isolation beyond these surface-reduction measures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in the Windows Storport Miniport Driver, the Microsoft-supplied storage port driver (storport.sys) that sits between the Windows storage stack and vendor miniport drivers for storage host bus adapters, RAID controllers and similar devices. In this class of defect, a memory object associated with driver-managed I/O structures is freed while still referenced, so a subsequent operation dereferences stale memory; an attacker who can influence that timing can cause memory corruption, a system crash (the reported DoS angle, corresponding to the 'Denial Of Service', 'Use After Free' and 'Memory Corruption' tags) or, in the worst case, kernel-mode code execution running with the highest privilege on the host. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates the attack is network-reachable, low complexity, requires no credentials but does require some form of user interaction, and that a successful exploit fully compromises confidentiality, integrity and availability of the affected system. The EUVD data scopes the vulnerable code to Windows Server 2025 (including the Server Core installation) builds from 10.0.26100.0 up to, but not including, 10.0.26100.33650, and ENISA tracks the issue as EUVD-2026-99887; Microsoft attributes the report internally via secure@microsoft.com.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Retaining PR:N and UI:R as given; AV:N is accepted on the vendor-stated network path though the storage-driver delivery mechanism is unverified, with total CIA impact matching kernel-level code execution.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Storport Miniport Driver allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft's Windows Server 2025 platform, including Server Core deployments, carries a high-severity kernel driver flaw in storport.sys that could let an unauthenticated network attacker who induces a user action gain kernel-level control of a server. The business exposure is concentrated in storage-dependent and internet-exposed server estates, where a compromised host could disrupt critical services; however, no public exploit identified at time of analysis and a vendor fix is available, so leadership should treat this as a manageable but urgent patch-priority issue.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB