CVE-2026-56188 is a Windows Server Network driver remote code execution vulnerability caused by a race condition. Microsoft rates it Critical with a CVSS v3.1 base score of 9.8 and temporal score of 8.5. The vector is network-based with low attack complexity, no privileges required, and no user interaction required; confidentiality, integrity, and availability impacts are all high. Microsoft states the issue is not publicly disclosed, not exploited, and exploit code maturity is unproven, but it is labeled “Exploitation More Likely.” This is high enterprise risk for network-exposed Windows systems because it can be triggered by specially crafted malicious traffic.

Highlights:
- CVSS scores: Base 9.8 - Temporal 8.5
- Exploit status & code maturity: Publicly Disclosed: No; Exploited: No; Exploit Code Maturity: UNPROVEN.
- Impact: Remote Code Execution with HIGH confidentiality, integrity, and availability impacts.
- Exploitation likelihood: Exploitation More Likely; network vector, LOW attack complexity, NO privileges required, and NO user interaction increase remote attack feasibility.
- Severity for enterprise: Critical severity; higher risk for internet-facing or otherwise network-exposed Windows Server deployments because exploitation does not require authentication or user interaction.
- Patch status: available; customer action required.

Affected systems:
- Windows 10 1607
- Windows 10 1809
- Windows 10 21H2
- Windows 10 22H2
- Windows 11 24H2
- Windows 11 25H2
- Windows 11 26H1
- Windows 11 unspecified
- Windows Server 2012
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
- Windows Server 2025