Microsoft Warns of Critical Remote Code Execution Flaw in Windows Kernel

Microsoft has released an emergency security advisory for CVE-2026-28420, a critical vulnerability in the Windows kernel that enables remote code execution without requiring authentication. The flaw, rated 9.8 out of 10 on the CVSS scale, affects all supported versions of Windows including Windows 10, Windows 11, Windows Server 2019, and Windows Server 2022.

The vulnerability exists in the Windows kernel's handling of specially crafted network packets. An attacker can exploit this flaw by sending malicious packets to a vulnerable system, potentially gaining complete control over the affected machine. Microsoft reports that the vulnerability is being actively exploited in the wild, making immediate patching critical.

Affected Systems:

• Windows 10 version 1809 and later
• Windows 11 version 21H2 and later
• Windows Server 2019
• Windows Server 2022
• Windows Server version 20H2 and later

Microsoft has released security updates to address the vulnerability. Organizations should prioritize patching systems exposed to the internet or handling sensitive data. The company recommends enabling automatic updates or manually installing the patches as soon as possible.

For mitigation, Microsoft suggests:

• Apply security updates immediately
• Restrict network access to vulnerable systems
• Monitor network traffic for suspicious patterns
• Implement network segmentation where possible

This vulnerability follows a pattern of high-severity Windows kernel flaws discovered in recent months. Security researchers note that kernel-level vulnerabilities remain particularly dangerous due to their ability to bypass security controls and gain system-level privileges.

Organizations unable to immediately patch should consider implementing additional network controls and monitoring for indicators of compromise. Microsoft's security advisory includes detailed technical information for security teams investigating potential exploitation attempts.

The discovery of CVE-2026-28420 underscores the ongoing challenge of securing complex operating systems against sophisticated attack techniques. Microsoft's rapid response and patch deployment demonstrate the importance of maintaining current security updates across enterprise environments.