Microsoft Releases Critical Security Update for CVE-2026-22997

Microsoft has released an urgent security update to address CVE-2026-22997, a critical vulnerability that poses significant risk to Windows operating systems. The vulnerability has been assigned a CVSS score of 9.8 out of 10, indicating its severe nature and potential for widespread impact.

The flaw affects Windows 10 versions 1809 through 22H2, Windows 11 versions 21H2 and 22H2, and Windows Server 2019 and 2022. Microsoft reports that the vulnerability could allow remote code execution without authentication, enabling attackers to take complete control of affected systems.

According to Microsoft's Security Update Guide, the vulnerability exists in the Windows Remote Procedure Call (RPC) service. An attacker could exploit this flaw by sending specially crafted network packets to a targeted system, potentially bypassing existing security controls.

Microsoft has observed limited targeted attacks exploiting this vulnerability in the wild. The company urges all users to apply the security update immediately through Windows Update or by downloading the patches directly from the Microsoft Update Catalog.

For enterprise environments, Microsoft recommends prioritizing systems that are internet-facing or have high-value data. The update requires a system restart to complete installation.

Additional technical details about CVE-2026-22997, including affected components and mitigation strategies, are available through Microsoft's Security Response Center. Organizations should review their incident response plans and monitor systems for unusual activity following patch deployment.

Microsoft has not disclosed specific details about the vulnerability's discovery or attribution, citing security concerns. The company typically follows a coordinated disclosure process, working with security researchers and providing advance notice to enterprise customers before public release.

Users can verify successful patch installation by checking Windows Update history or running system information commands. Microsoft continues to monitor for new exploitation attempts and may release additional guidance as the situation develops.