CVE‑2026‑7168 – Remote Code Execution in Windows SAM

Impact

• Affected products: Windows Server 2022, Windows 11 (all builds up to 23H2), Windows 10 21H2 and later.
• Severity: CVSS v3.1 base score 9.8 (Critical). Attackers can gain SYSTEM privileges.
• Attack vector: Remote exploitation via specially crafted RPC requests to the Security Account Manager service.
• Real‑world risk: Successful exploitation permits full control over the target machine, persistence, lateral movement, data exfiltration, and installation of backdoors.

Technical Details

• The flaw resides in the SAM’s handling of the SamrQueryInformationPolicy2 RPC call. An attacker can send a malformed request that causes a buffer overflow in the kernel‑mode driver.
• The overflow corrupts the return address on the stack, redirecting execution to attacker‑controlled code.
• The vulnerability is remote; no local privileges are required. It can be triggered from any network segment that can reach the SAM RPC endpoint (default port 445).
• The exploit chain requires no user interaction; a single crafted packet is sufficient.

Mitigation Steps

1. Apply the official patch immediately. Download from the Microsoft Security Update Guide: CVE‑2026‑7168.
2. Disable SMBv1 if still enabled, as the SAM RPC endpoint is exposed over SMB.
3. Restrict RPC traffic to trusted hosts using Windows Firewall or network segmentation.
4. Enable Credential Guard on all domain controllers and high‑value servers.
5. Verify integrity of the SAM database by running sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth.
6. Monitor for anomalous RPC activity using Windows Event ID 4624 (logon) and 4688 (process creation).

Timeline

• 2026‑04‑12: CVE disclosed by Microsoft.
• 2026‑04‑15: Patch released for all affected versions.
• 2026‑04‑20: Advisory issued to all customers.
• 2026‑05‑01: Microsoft recommends immediate patching; no known public exploits yet.

Further Resources

• Microsoft Security Update Guide: CVE‑2026‑7168
• Windows Security Documentation: SAM Security
• Community discussion on GitHub: SAM Vulnerability Analysis

Bottom Line

This vulnerability is a high‑risk, remote code execution flaw that can be leveraged to take full control of Windows Server 2022 and Windows 11 systems. Apply the patch without delay, harden your network, and monitor for suspicious activity. Failure to act exposes your organization to immediate compromise.