CVE-2026-56188

CVE Enrichment

CVSS: 8.1 HIGH
EPSS: 0.61%
EPSS Percentile: 48.83%
CISA KEV: Not listed

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unauthorized attacker to execute code over a network.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 15-Jul-2026 01:18
Last Modified: 22-Jul-2026 23:18
EPSS Date: 2026-10-27
CWE: CWE-362

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

microsoft / windows_10_1607 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.14393.9339
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
microsoft / windows_10_1607 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.14393.9339
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
microsoft / windows_10_1809 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.17763.9020
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
microsoft / windows_10_1809 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.17763.9020
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
microsoft / windows_10_21h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19044.7548
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
microsoft / windows_10_22h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19045.7548
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
microsoft / windows_11_24h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26100.8875
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*
microsoft / windows_11_25h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26200.8875
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*
microsoft / windows_11_26h1 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.28000.2525
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:*:*
microsoft / windows_server_2012 Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
microsoft / windows_server_2012 Source: NVD CPE · affected
Version / affected range: r2
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
microsoft / windows_server_2016 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.14393.9339
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
microsoft / windows_server_2019 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.17763.9020
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
microsoft / windows_server_2022 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.20348.5386
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
microsoft / windows_server_2025 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26100.33158
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 28-Oct-2026 20:55
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Protocol (CVE-2026-56190), Windows DHCP Server (CVE-2026-50518), Windows Server Network driver (CVE-2026-56188), and Minecraft Bedrock Dedicated Server (CVE-2026-55010) also deserve increased attention. Microsoft Patches 622 Vulnerabilities, Including Two Exploited Zero-Days

CVE (9)

People (2)

Vendors (1)

Products (11)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.