CVE-2026-58608

Windows Print Spooler Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 45th percentile. A vendor fix is available.

CVSS 3.18.8High EPSS percentile45th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-22Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which systems run Microsoft Windows Print Spooler (printing enabled and Print Spooler service present) and note their exact Windows version/build.
Compare your Windows version/build to the fixed versions below and identify which machines are behind.
Patch the affected Windows machines to the fixed builds listed for your branch (do not stop at “a newer update” if it’s not the specific fixed build).
If patching will take time, reduce exposure by disabling the Print Spooler service on machines that do not need printing, and restrict network access to printer-related services to only trusted admins/hosts.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to execute code over a network.

In plain language

Written by AI from the record

CVE-2026-58608 is a Windows Print Spooler flaw that lets an attacker run malicious code remotely, and you should patch it if you use Windows printing or have the Print Spooler running on exposed machines.

CVE-2026-58608 is a remote code execution issue in Windows Print Spooler caused by a race condition in shared resource handling, allowing an authorized attacker to trigger the flaw over the network with no user interaction.

If you're affected

Full device compromise
Ransomware installation risk
Data theft from the PC
Service disruption via printer outage

What is it

Windows’ Print Spooler is the background service that manages printing tasks. This vulnerability is like a timing bug in how it shares and coordinates work: under certain conditions, an attacker can force it to do something it shouldn’t, including running their own code. Because it works over the network and doesn’t require a user to click anything, it’s especially important to keep printing-related systems up to date.

Who is affected

This matters if you run Windows 10, Windows 11, or Windows Server (2012–2025) machines with the Print Spooler enabled/used, especially if those machines are reachable by other devices on your network or by administrators. The risk is not just “internet-exposed”—the flaw requires an attacker with authorized access to the print spooler system (described as low), and it is reachable via the network.

In practice: prioritize systems where an attacker could already gain low-level access or reach printer services on the host.

How urgent is it

This is RED because it’s a remote code execution flaw in a core Windows printing component, and attackers can trigger it over the network without any user interaction. Even though CISA KEV does not list this CVE, the existence of a race-condition RCE with available fixed builds means you should treat it as an urgent patching item for any machine with Print Spooler enabled.

What to do — in detail

Confirm whether you’re exposed

Identify all affected Windows machines (Windows 10/11 and Windows Server 2012–2025).
On each machine, confirm whether Print Spooler is in use (printing enabled, printer drivers configured, or Print Spooler service running). The vulnerability targets the Windows Print Spooler.
Record the exact Windows version/build number. Use your system’s “About” page or your standard inventory method.

Check for the fixed versions

Patch any machine that is not at (or beyond, where applicable) the fixed build for its branch:

Windows 10 → fixed in:
- 10.0.14393.9339
- 10.0.17763.9020
- 10.0.19044.7548
- 10.0.19045.7548
Windows 11 → fixed in:
- 10.0.26100.8875
- 10.0.28000.2525
Windows Server 2012 → fixed in 6.2.9200.26226
Windows Server 2012 R2 → fixed in 6.3.9600.23291
Windows Server 2016 → fixed in 10.0.14393.9339
Windows Server 2019 → fixed in 10.0.17763.9020
Windows Server 2022 → fixed in 10.0.20348.5386
Windows Server 2025 → fixed in 10.0.26100.33158

Upgrade/patch guidance

Apply the vendor/security updates that land you on the specific fixed build listed above for your OS branch.
If you manage updates centrally (WSUS/Intune/SCCM), ensure the approved update set for each branch includes the fixed build, not just “latest.”

Temporary workaround (if you can’t patch immediately)

If the machine does not need printing: disable the Print Spooler service and stop any related printer sharing features until updates are installed.
If printing is required: restrict printer access and network reachability so only trusted admin/print hosts can access the spooler-related services.

What to monitor

After patching, verify the build number changed to one of the fixed versions above.
Watch printer-related logs and any unusual authentication attempts against print services (based on your normal monitoring process).

KEV / deadline

This CVE is not listed in CISA KEV based on the provided findings, so no specific CISA due date is provided here.

Technical context

CVE-2026-58608 is a Windows Print Spooler remote code execution vulnerability involving a race condition (CWE-362) in shared resource handling and improper synchronization (CWE-416). The attack vector is network, and user interaction is not required.

From the findings: an authorized attacker can execute arbitrary code remotely over the network. Exploitation status in the provided sources is not confirmed as public “in the wild” reporting (no clear dated press claim) and there is no public exploit code on record. CISA KEV listing is not present in the provided findings.

Mitigation is to update to the fixed builds listed per Windows branch (e.g., Windows 10 fixed in 10.0.14393.9339 / 10.0.17763.9020 / 10.0.19044.7548 / 10.0.19045.7548; Windows 11 fixed in 10.0.26100.8875 / 10.0.28000.2525; Windows Server branches fixed in the specific builds provided).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS45th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 45th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 8 days, from the signal feeds we watch.

2026-07-22Patch availablerecord updated
2026-07-20Patch availablerecord updated
2026-07-16OpenVAS check added
2026-07-15Record updatedrecord updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 22 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable