Critical Microsoft Vulnerability CVE-2026-43274 Requires Immediate Action

Microsoft has issued an urgent security advisory for CVE-2026-43274, a critical vulnerability affecting multiple Microsoft products. The vulnerability allows remote code execution with no user interaction required.

The vulnerability exists in the way Microsoft Windows handles objects in memory. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system.

Affected products include:

• Windows 10 (Version 21H2 and later)
• Windows 11 (Version 22H2 and later)
• Windows Server 2022
• Windows Server 2019
• Microsoft Edge (Chromium-based)

The vulnerability has been assigned a CVSS score of 8.8 (High) for the Windows client versions and 9.8 (Critical) for server versions due to the potential for system compromise.

Microsoft has released security updates to address this vulnerability. Organizations should apply these updates immediately. The updates are available through Windows Update and the Microsoft Update Catalog.

For systems that cannot be updated immediately, Microsoft recommends the following mitigations:

1. Enable Windows Defender Application Control
2. Deploy network-level rules to block inbound connections to affected systems
3. Enable Exploit Guard
4. Configure Windows Defender Antivirus to enable tamper protection

The security updates will be deployed automatically via Windows Update on Patch Tuesday, but manual deployment is recommended for critical systems. Microsoft has confirmed that active exploitation of this vulnerability is already occurring in the wild.

For detailed information about the vulnerability and the available updates, refer to the Microsoft Security Advisory and the Security Update Guide.

Organizations should also review their incident response procedures in case the vulnerability is exploited before patches can be applied. Microsoft has indicated that they will provide additional guidance through their MSRC blog if the threat landscape evolves.