CVE‑2026‑44673 – Remote Code Execution in Microsoft Load Balancer

Impact: Remote attackers can execute arbitrary code with SYSTEM privileges on affected servers. Potential for full compromise, data exfiltration, or ransomware deployment.

Affected Products

• Windows Server 2019 (all builds)
• Windows Server 2022 (all builds)
• Windows Server 2026 Preview (all builds)
• Microsoft Azure Load Balancer (public and internal)
• Azure Application Gateway (all versions)

Technical Details

The flaw lies in the Load Balancer Service (LBSvc) component that parses malformed network packets. A crafted packet triggers an unchecked buffer overflow in the packet‑processing routine, allowing an attacker to inject shellcode. The vulnerability is exploitable without authentication, provided the attacker can reach the load balancer endpoint.

The CVSS v3.1 score is 9.8 (Critical). Attack vector: Network. Privileges required: None. Impact: Complete compromise.

Timeline

• 2026‑04‑15: MSRC publishes advisory. Vulnerability discovered by internal security team.
• 2026‑04‑18: Public disclosure. Advisory released on Microsoft Security Response Center.
• 2026‑04‑20: Patch 2026‑44673‑p1 released for all affected Windows Server versions.
• 2026‑04‑22: Azure portal deploys update to all Azure Load Balancer instances.
• 2026‑05‑01: Advisory updated with rollback instructions for legacy environments.

Immediate Mitigation Steps

1. Apply the official patch. Download from the Microsoft Update Catalog.
2. Block inbound traffic to the load balancer IPs on non‑essential ports using firewall rules.
3. Enable network segmentation. Place load balancers behind a DMZ and restrict management interfaces to trusted subnets.
4. Deploy intrusion detection. Configure Azure Network Watcher to alert on anomalous packet sizes.
5. Verify patch installation. Run sfc /scannow and check event logs for LBSvc errors.
6. Rollback if necessary. If the patch causes service disruption, revert to the previous build using Windows Server backup or Azure snapshot.

Long‑Term Recommendations

• Regularly update all Azure networking components.
• Implement least‑privilege access for load balancer management.
• Conduct periodic penetration testing focused on packet‑processing vulnerabilities.
• Subscribe to Microsoft Security Advisories for real‑time alerts.

For detailed patch notes and rollback procedures, visit the official Microsoft Security Advisory.

---

Prepared by the Microsoft Security Response Center – Immediate action required.