Microsoft has issued an emergency security update to address CVE-2026-27135, a critical Windows vulnerability that allows remote code execution without authentication.
Microsoft has released an emergency security update to address CVE-2026-27135, a critical vulnerability in Windows operating systems that could allow attackers to execute arbitrary code remotely without requiring authentication.
The vulnerability affects all supported versions of Windows, including Windows 10, Windows 11, and Windows Server editions. Microsoft rates the severity as "Critical" with a CVSS score of 9.8 out of 10.
Technical Details
The vulnerability exists in the Windows Remote Procedure Call (RPC) service, specifically in how it handles certain malformed requests. Attackers can exploit this flaw by sending specially crafted network packets to vulnerable systems, potentially gaining complete control over affected machines.
Key technical aspects:
- Attack vector: Network-based
- Authentication required: None
- Impact: Remote code execution
- Affected components: Windows RPC service
Affected Systems
Organizations should immediately assess their exposure:
- Windows 10 versions 1809 through 22H2
- Windows 11 versions 21H2 through 24H2
- Windows Server 2019 and 2022
- Windows Server 2025 (all editions)
- Windows IoT Core editions
Mitigation Steps
Microsoft strongly recommends immediate action:
- Apply the security update immediately through Windows Update
- Enable automatic updates if not already configured
- Block inbound RPC traffic at network perimeter firewalls as temporary mitigation
- Monitor network traffic for suspicious RPC requests
Update Timeline
The security update was released on April 14, 2026, outside of Microsoft's regular Patch Tuesday schedule, indicating the severity of the threat. The company coordinated with major cloud providers and enterprise customers before public release.
Detection and Verification
Administrators can verify patch installation by checking:
- Windows Update history for KB5034567
- Registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows\SecurityUpdate\2026_04_14 - Event ID 1 in Windows Event Viewer
Additional Resources
Organizations are advised to prioritize patching systems exposed to the internet or those in high-risk environments. The vulnerability is already being actively exploited in limited targeted attacks, according to Microsoft's threat intelligence.
Comments
Please log in or register to join the discussion