CVE-2026-66802

This vulnerability is a flaw in how Windows’ device attestation services handle certain actions at the same time. If an attacker can reach the relevant network service, the timing mistake can let them run their own code on the affected Windows machine—like taking control of a door by exploiting a construction error in how the lock is managed.

This matters to you if you run Windows 10, Windows 11, or Windows Server 2019/2022/2025 systems that use Windows Device Health Attestation (DHA) / Attestation service components. It’s most relevant when the attestation functionality is reachable over a network path an attacker can use. If your DHA/Attestation usage is off or not network-accessible from untrusted sources, the risk is lower.

Treat this as urgent (RED) because it’s a remote code execution issue in Windows’ device attestation path, which means a network attacker can potentially gain control of a vulnerable system. The report is new and prompted a patch, and security attention indicates sophisticated threat activity may be involved.

1. Identify exposure scope (what to check)

   • Inventory your Windows 10/11 and Windows Server 2019/2022/2025 machines.
   • Determine whether those machines participate in Device Health Attestation (DHA) / Attestation service usage (for example, any configuration or features that rely on device health attestation).
   • Note which systems have network connectivity to any DHA/Attestation endpoints.

2. Confirm patch status

   • For each candidate machine, capture the exact OS version/build number.
   • Compare it to the fixed versions Microsoft lists for CVE-2026-66802 (patch cards in the Update Guide):
     • Windows 10: fixed in 10.0.17763.9121
     • Windows 11: fixed in 10.0.28000.2704
     • Windows Server 2019: fixed in 10.0.17763.9121
     • Windows Server 2022: fixed in 10.0.20348.5499
     • Windows Server 2025: fixed in 10.0.26100.33296

3. Upgrade/patch

   • Install the Microsoft updates referenced in the Microsoft Update Guide for CVE-2026-66802.
   • Upgrade the affected systems to at least the fixed build for their OS. (Do not stop at a partial/previous cumulative update—verify the build number after patching.)

4. Temporary risk reduction if patching is delayed

   • Reduce network exposure of any DHA/Attestation usage: limit which networks can reach the attestation-related service paths and avoid exposing them to the public internet.
   • If your environment allows, disable or restrict DHA/Attestation functionality until patching is complete.

5. After patching: verification and monitoring

   • Re-check the build number to confirm it matches the fixed versions.
   • Monitor Windows security logs and system logs for unusual behavior around the attestation components (especially if you recently changed connectivity).

Notes on exploitation status

• There is no public exploit code on record in the findings provided.
• The findings also note press attention, but KEV (known exploited vulnerabilities) is not listed—so prioritize patching based on the remote code execution impact and the provided fixed versions.

CVE-2026-66802 is classified as CWE-362 (race condition) and CWE-416 (use-after-free). The vulnerability involves concurrent execution using a shared resource with improper synchronization, allowing an attacker to trigger unauthorized behavior through the network in Microsoft Azure Attestation / Windows Device Health Attestation (DHA) services. The reported impact is high (CVSS 8.1) with network reachability and no user interaction required per the provided context.

Findings summary and maturity:

• KEV: not listed in CISA KEV.
• Exploitation: no public exploit code on record.
• EPSS: a low predicted likelihood figure was provided, but the public-facing decision is still RED due to the severe remote code execution potential and new patch/press attention.
• Patch availability: Microsoft provides fixed Windows build versions for each affected supported OS.

What KEV absence means here:

• “Not listed in KEV” means it’s not confirmed as widely exploited in the CISA dataset at the time of the findings; however, the vulnerability still warrants prompt remediation because remote code execution is possible if the relevant service path is reachable.