CVE-2026-4891 – Remote Code Execution in Windows 10 SMB

Impact

• Affected: Windows 10, version 22H2 and earlier, SMBv3 service.
• Severity: CVSS 9.8 (Critical).
• Risk: An attacker can execute arbitrary code with SYSTEM privileges by sending a crafted SMB packet.
• Timeline: Public disclosure on 2026‑04‑12. Patch released 2026‑04‑18.

Technical Details

The flaw lies in the handling of the SMB_COM_TRANSACTION2 request. A malformed TreeConnect packet bypasses the authentication check, allowing an unauthenticated remote host to trigger a stack buffer overflow. The overflow lands in the kernel, granting the attacker full control of the host. The exploit chain requires only network access to the target’s SMB port (TCP 445) and no credentials.

Mitigation Steps

1. Apply the patch. Download the latest cumulative update for Windows 10 from the Microsoft Update Catalog: KB500XXXX.
2. Disable SMBv3 if the service is not required. Run Set-SmbServerConfiguration -EnableSMB2Protocol $false in PowerShell.
3. Block inbound SMB traffic on the perimeter firewall. Allow only trusted IP ranges.
4. Deploy endpoint protection that blocks anomalous SMB packets. Use Microsoft Defender ATP or a comparable solution.
5. Verify that the patch applied by checking the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Security\KB500XXXX.

Additional Resources

• Microsoft Security Update Guide – CVE‑2026‑4891
• SMB Vulnerability Exploit Guide
• Windows Update Catalog – KB500XXXX

Conclusion

The CVE‑2026‑4891 flaw presents a high‑risk vector for attackers. Immediate patching and network hardening are mandatory. Monitor Microsoft advisories for any follow‑up patches or additional mitigations.