CVE-2026-71331

This vulnerability is like a “crash-and-take-over” bug in how Windows’ attestation service processes specially crafted network messages. If someone can reach that service and trigger the bad input handling, they can run code on the server with very high privileges, which can lead to total compromise.

This matters if you run or expose Microsoft Azure Attestation / Windows Device Health Attestation services on Windows 10, Windows Server 2019, Windows Server 2022, or Windows Server 2025. Even though authentication and user interaction are not required, it still requires that an attacker can reach and successfully trigger the faulty processing path in the attestation service.

Put simply: it’s a risk primarily when those attestation components are reachable over the network from an attacker.

This is RED because it can lead to high-privilege remote code execution over the network, meaning a successful attack can fully compromise a machine. The tracking information also indicates this is associated with a serious threat actor, and the main control available is to apply the official fixes.

Confirm exposure

• Identify which servers/desktops run Windows 10 / Windows Server 2019 / Windows Server 2022 / Windows Server 2025.
• For each, confirm whether Microsoft Azure Attestation service and/or the Windows Device Health Attestation service is in use.
• Check whether those attestation service endpoints are reachable from anything beyond your trusted network (the safest assumption is: avoid exposure to the internet and untrusted networks).

Verify patch status

• For each affected host, check the installed Windows build and compare against the fixed versions:
  • Windows 10 → fixed in 10.0.17763.9121
  • Windows Server 2019 → fixed in 10.0.17763.9121
  • Windows Server 2022 → fixed in 10.0.20348.5499
  • Windows Server 2025 → fixed in 10.0.26100.33296

Apply the fix

• Install Microsoft’s security update that includes the above fixed builds (use the Microsoft update guide linked by the vendor for CVE-2026-71331).
• Reboot if your update process requires it and confirm the system build has moved to the fixed version.

If patching is delayed (temporary containment)

• Block inbound access to the attestation service endpoints from the internet and any untrusted networks.
• Allow only the specific management/partner networks that truly need access.
• Reduce exposure further by tightening firewall rules and network routing so the service cannot be reached from arbitrary remote clients.

What to monitor

• Monitor attestation-related logs for unusual requests or errors around the time of network activity.
• Look for unexpected process creation or service crashes on hosts where the attestation service is running.

Timeline

• Given the RED verdict and the high impact (remote code execution with high privileges), complete patching as soon as possible according to your change-management schedule; do not leave this exposed for extended maintenance cycles.

Severity/impact: The vulnerability enables remote execution of arbitrary programs with high privileges (remote code execution), with significant confidentiality and integrity risk (and the possibility of service disruption).

Mechanism: The core issue is an integer overflow/wraparound during processing of specially crafted network input to Microsoft Azure Attestation / Windows Device Health Attestation services. This arithmetic fault can be leveraged to divert execution so the attacker can run code.

Authentication/interaction: Findings indicate authentication is not required and there is no user interaction.

Network reachability: Attack vector is listed as network. Whether it is reachable in default configuration is unknown in the findings, so exposure depends on whether your attestation service endpoints can be reached and whether the attacker can successfully hit the vulnerable processing condition.

Exploitation status: No KEV listing was reported, and no clear dated press exploitation claim is provided. No public exploit code is on record.

Threat context: Threat tracking (PULSE) associates activity with the Lazarus group, and patch availability is confirmed via Microsoft’s update guidance.

EPSS: A prediction is provided in the findings, but public blocks should not treat it as proof; prioritize patching due to high impact and the confirmed fix information.