CVE-2026-69530

Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 52nd percentile. No fix published yet.

CVSS 3.18.1High EPSS percentile52nd0.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-08Updated 2026-09-09Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check which Windows versions you run (Windows 10, Windows Server 2019/2022/2025) and review your patch history for RMCAST/security updates.
For Windows 10 and Windows Server 2019, update to at least 10.0.17763.9245.
For Windows Server 2022, update to at least 10.0.20348.5622.
For Windows Server 2025, update to at least 10.0.26100.33438.
After updating, confirm the update shows as installed in Windows Update / your server update reporting tool.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

This Windows remote code execution flaw can let an attacker run code from the network in certain RMCAST (Reliable Multicast Transport Driver) situations, so most small businesses running Windows 10 or Windows Server should act quickly to install the fixed updates.

CVE-2026-69530 is a remote code execution vulnerability caused by a use-after-free condition in the Windows Reliable Multicast Transport Driver (RMCAST); an attacker can trigger it over the network without user interaction, leading to potential system compromise.

If you're affected

Full computer takeover
Malware installation
Ransomware risk
Service disruption

What is it

Think of RMCAST as a network “traffic handoff” driver inside Windows. This bug can mistakenly reuse memory it should have stopped using, and that mistake can be turned into attacker-controlled code over the network.

Who is affected

This matters if you run Windows 10 or Windows Server 2019/2022/2025 on computers that can receive network traffic that reaches the RMCAST component. The vulnerability is reachable over the network without needing a logged-in user. Apply the fix if your environment matches those Windows versions, because the driver runs as part of Windows networking behavior.

How urgent is it

This is a RED issue because it’s a remote code execution vulnerability in Windows networking, meaning an attacker may be able to run code from the network without user interaction. Even though there’s no confirmed public exploit code listed and it’s not in the CISA KEV catalog, you should still prioritize patching immediately to reduce exposure on internet- or network-facing systems.

What to do — in detail

Inventory and confirm exposure
- Identify which devices run Windows 10, Windows Server 2019, Windows Server 2022, and Windows Server 2025.
- For each device, check the current Windows build/version.
Determine whether the update is already installed
- Compare your current Windows build/version to the fixed builds:
  - Windows 10 / Windows Server 2019: fixed in 10.0.17763.9245
  - Windows Server 2022: fixed in 10.0.20348.5622
  - Windows Server 2025: fixed in 10.0.26100.33438
- If your build is older than the fixed build, it’s not fully patched.
Upgrade/patch (apply the vendor fix)
- Use Windows Update, WSUS, or your standard patching process to install the Microsoft update for CVE-2026-69530.
- Follow normal maintenance windows as needed, but prioritize servers and any internet-facing endpoints.
Verification after patching
- Confirm the update is installed successfully (via Windows Update history and/or server management tooling).
- Re-check the Windows build/version matches or exceeds the fixed build number for your OS.
Temporary workaround if patching is delayed
- Reduce the reachable network surface: limit inbound network access to only what’s necessary for the device/role.
- If you have a firewall policy that restricts which networks can reach Windows networking components, tighten those rules for affected systems until patches are applied.
Monitor
- Review security logs and network logs for unusual traffic patterns targeting Windows networking services on affected hosts.
- Continue to track Microsoft’s update guidance for CVE-2026-69530 through the update guide page.
CISA due date
- Not listed in CISA KEV in the provided findings, so no CISA action due date is known from this dataset.

Technical context

CVE-2026-69530 is a Windows kernel/networking driver remote code execution issue in the Reliable Multicast Transport Driver (RMCAST). The underlying weakness is use-after-free (CWE-416), meaning the driver can reference memory after it has been freed; an attacker can then manipulate program behavior to execute code.

From the provided findings: it is not in CISA KEV, there is no public exploit code recorded, and press attention is noted (Qualys roundup) but no exploitation status is confirmed. The predicted likelihood (EPSS) is provided as a small value with a flat trend, and per the rules this likelihood is not used as a deciding factor in public-facing urgency because the issue is assessed as RED overall. Fixed versions are specific by Windows release (10.0.17763.9245 for Windows 10/Server 2019; 10.0.20348.5622 for Server 2022; 10.0.26100.33438 for Server 2025).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS52nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.7% chance of exploitation activity in the next 30 days, which ranks it in the 52nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 2 days, from the signal feeds we watch.

2026-09-10OpenVAS check added
2026-09-09Record updated
2026-09-08Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US

And 2 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable