CVE-2026-54999

Windows TCP/IP is the networking “plumbing” that Windows uses to send and receive data. This bug is a timing flaw: when TCP/IP code runs in parallel, it can be tricked on the same local network into running attacker code. Think of it like two workers trying to use the same tool at the same time—if the process isn’t properly controlled, someone can grab control instead of just using the tool.

This matters if your business uses any of these operating systems: windows 10, windows 11, windows server 2012, windows server 2012 r2, windows server 2016, windows server 2019, windows server 2022, or windows server 2025. The risk is for an attacker who has network access on the adjacent (local) network, and the vulnerability does not require a login or user interaction. Reachability is a gate: it’s a risk only if an attacker can reach the target machine over that adjacent network path.

This is a RED issue because it allows remote code execution from an adjacent network without authentication, meaning a nearby attacker on your network could potentially take full control. Even though there’s no clear dated public exploitation report and no public exploit code on record, the impact is high and the fix is available.

1. Inventory affected systems
   • Confirm which endpoints and servers run: windows 10, windows 11, windows server 2012, windows server 2012 r2, windows server 2016, windows server 2019, windows server 2022, windows server 2025.
2. Check current versions/builds
   • On each machine, review the Windows “About” screen (or via your patch management/IT inventory tool) to capture the exact version/build.
3. Determine whether each machine is still vulnerable
   • Compare each build against the fixed versions below. If your current build is older than the listed fixed build for your specific OS line, plan an update.
4. Patch to the fixed versions (apply the appropriate one for each OS)
   • windows 10:
     • fixed in 10.0.14393.9339
     • fixed in 10.0.17763.9020
     • fixed in 10.0.19044.7548
     • fixed in 10.0.19045.7548
   • windows 11:
     • fixed in 10.0.26100.8875
     • fixed in 10.0.26200.8875
     • fixed in 10.0.28000.2525
   • windows server 2012: fixed in 6.2.9200.26226
   • windows server 2012 r2: fixed in 6.3.9600.23291
   • windows server 2016: fixed in 10.0.14393.9339
   • windows server 2019: fixed in 10.0.17763.9020
   • windows server 2022: fixed in 10.0.20348.5386
   • Note: A machine must be updated to the fixed build that matches its OS branch; do not assume one version number fixes every edition.
5. Temporary mitigation if patching is delayed
   • Reduce “adjacent network” reachability: tighten internal firewall rules so only necessary systems can talk to each other.
   • Segment guest/Wi‑Fi devices away from servers and administrative endpoints (so an attacker on the same local network has fewer paths).
6. Verify after patching
   • Re-check the build number after updates complete to confirm you reached the fixed version.
7. What to monitor while rolling out fixes
   • If you have central logging, watch for unusual network activity targeting Windows networking services and any unexpected process creation shortly after network events.
8. KEV/CISA guidance note
   • This vulnerability is not listed in CISA KEV based on the provided findings; still, act because it is a remote code execution bug with authentication-free conditions.

Severity is high in practice because the weakness is CWE-362 (race condition) in Windows TCP/IP, and the impact is remote code execution. The findings indicate: remote code execution capability, no authentication required, no user interaction required, and precondition of network access on the adjacent network. Exploitation status in the provided findings: KEV is not listed, press does not provide a clear dated exploitation claim, and there is no public exploit code on record—however, a RED verdict still applies because the vulnerability class and impact are severe and it has a patch available. The fix availability is evidenced by multiple fixed Windows build numbers across client and server branches (Windows 10/11 and Windows Server 2012–2022).