CVE-2026-56181

CVE Enrichment

CVSS: 8.3 HIGH
EPSS: 0.28%
EPSS Percentile: 19.82%
CISA KEV: Not listed

Description

Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 15-Jul-2026 01:18
Last Modified: 22-Jul-2026 23:18
EPSS Date: 2026-10-25
CWE: CWE-346

CVSS Vector


            CVSS:3.1                            AV:A /
                            AC:H /
                            PR:N /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

microsoft / windows_11_24h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26100.8875
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*
microsoft / windows_11_25h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26200.8875
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*
microsoft / windows_11_26h1 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.28000.2525
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:*:*
microsoft / windows_server_2025 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26100.33158
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 03-Nov-2026 05:04
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Two CVEs have been assigned to date: CVE-2026-56181, affecting Microsoft Windows NAT in Hyper-V, and CVE-2026-63913, affecting the Linux netfilter conntrack subsystem. Black Hat USA 2026: Vendors Announce Security Products and Research

CVE (1)

People (1)

Vendors (14)

Products (19)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.