CVE-2026-45657

This is a mistake in how Windows kernel memory is handled: the system keeps a reference to something it has already released, and then an attacker can trick it into using that freed space. A good analogy is using a key you already threw away—if someone finds a way to get you to open the wrong door, they may be able to take control.

This matters to you if you use or run Microsoft Windows (including Windows 11 and Windows Server) on machines connected to a network. The affected systems listed are microsoft windows 11 23h2, microsoft windows 11 24h2, microsoft windows 11 25h2, microsoft windows 11 26h1, microsoft windows server 2022, and microsoft windows server 2025.

This is RED because the press indicates it is being exploited in the wild (“itw”), meaning attackers may already be attempting it against real targets. Even though public exploit details may not be widely available yet, the combination of a critical kernel flaw and active exploitation makes fast action important.

1. Identify all devices running the affected versions: microsoft windows 11 23h2, microsoft windows 11 24h2, microsoft windows 11 25h2, microsoft windows 11 26h1, microsoft windows server 2022, and microsoft windows server 2025.

2. Patch immediately: apply the most recent Microsoft security updates available for those systems (specifically the update that addresses CVE-2026-45657). Reboot if required by the update, and confirm the system is updated after reboot.

3. If any system cannot be updated right away:

• Reduce exposure by limiting inbound connections from the internet/VPN as much as practical.
• Ensure only necessary services are reachable from external networks; block or restrict anything not needed.

4. Monitoring/verification steps:

• Check for signs of compromise (unusual processes, unexpected admin actions, suspicious outbound connections) according to your normal incident checklist.
• Review logs for network access patterns around times you believe scanning or exploitation attempts could occur.
• Since KEV does not list this issue as known exploited, but press says “itw,” treat it as actively targeted and keep an eye on your monitoring tools after patching.

5. Operational follow-up:

• Validate that all endpoints and servers are fully patched (including “satellite” devices and systems people forget about).
• Tighten your patch workflow so kernel/security updates get applied quickly when exploitation is reported.

Severity: CRITICAL (CVSS 9.8). This is a Windows Kernel Remote Code Execution vulnerability caused by a “use after free” weakness in the kernel, where an attacker can influence how freed memory is reused to execute code. Attack vector: remote over a network.

Exploitation status: press indicates “itw” (exploited in the wild). Known exploited in the wild (CISA KEV): no. Public exploit available: no. Nuclei detection template exists: no. EPSS is listed as 0.1% estimated probability of exploitation in the next 30 days, which is low, but the presence of real-world exploitation (“itw”) is the primary reason the overall priority is RED.

Named actor in press: ShinyHunters (per provided info). Because it’s kernel-level and already being exploited, timely patching is the main mitigation; detection signatures may not exist yet given that no Nuclei template is available.