CVE‑2026‑43620 – Windows 11 Remote Code Execution

Impact

A critical flaw in the Windows 11 kernel allows attackers to execute arbitrary code with SYSTEM privileges. The vulnerability can be triggered over the network by sending a specially crafted packet to the SMBv3 protocol listener. Successful exploitation could lead to full system takeover, data exfiltration, and persistence.

Technical Details

CVE‑2026‑43620 is a buffer overflow in the SMBv3 file‑sharing stack. The flaw occurs when the kernel parses an unusually long file name field in a SMB2_CREATE request. The overflow corrupts the stack, enabling an attacker to inject shellcode. The exploit chain requires:

1. An authenticated or unauthenticated SMBv3 connection to the target.
2. Delivery of a crafted SMB2_CREATE packet with a file name exceeding 260 characters.
3. Successful overwrite of the return address on the kernel stack.

The vulnerability is rated CVSS 9.8 (Critical) due to its high impact and ease of exploitation.

Affected Versions

• Windows 11 Home, Pro, Enterprise, Education, and Server 2022
• All builds prior to Windows 11 24H2 (Build 22631.1)
• The issue is not present in Windows 10 or earlier releases.

Mitigation Steps

1. Apply the latest security update. Download the cumulative update for Windows 11 24H2 from the Microsoft Update Catalog. The package ID is KB5001332.
2. Verify the installation by running winver and ensuring the build number is 22631.1 or higher.
3. Disable SMBv3 on servers that do not require it: Set-SmbServerConfiguration -EnableSMB2Protocol $false.
4. Configure network segmentation to isolate critical servers from untrusted networks.
5. Enable Windows Defender Exploit Guard and set the Attack Surface Reduction rule Block SMBv3 for external traffic.

Timeline

• 2026‑04‑15 – Microsoft publishes the vulnerability advisory and releases the patch.
• 2026‑04‑18 – Advisory becomes public; CVE assigned.
• 2026‑04‑20 – Patch distribution begins via Windows Update.
• 2026‑04‑25 – Advisory recommends immediate action for all users.

What to Do Now

• Check compliance: Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth to ensure system integrity.
• Update immediately: Do not postpone the patch; attackers are already exploiting the flaw in the wild.
• Monitor logs: Look for unusual SMB traffic or failed SMB authentication attempts.
• Report incidents: If you detect exploitation, contact your security team and report to Microsoft via the Security Response Center.

Resources

• Microsoft Security Advisory – CVE‑2026‑43620
• KB5001332 – Windows 11 24H2 Cumulative Update
• SMBv3 Configuration Guide
• Windows Defender Exploit Guard

Act now. The flaw is actively exploited. Patch, verify, and harden your environment to prevent compromise.