OTPulse

Windows TCP/IP Remote Code Execution Vulnerability

Plan PatchCVSS 8.1CVE-2026-69913Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary

Use after free vulnerability in Windows TCP/IP stack allows an attacker to execute code remotely over the network. The vulnerability affects Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 across multiple versions and architectures.

What this means
What could happen
An attacker could send specially crafted network packets to execute arbitrary code on a Windows system, potentially gaining full control of engineering workstations, HMI systems, or historian servers that rely on Windows TCP/IP for industrial network communication.
Who's at risk
Windows 10 (versions 1607, 1809, 21H2, 22H2, multiple architectures), Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2016, 2019, 2022, and 2025 systems used in industrial control environments, particularly engineering workstations, historians, HMI servers, and any networked Windows systems supporting OT infrastructure.
How it could be exploited
An attacker sends malicious TCP/IP packets from a network location reachable by the target Windows system. The use-after-free flaw in the TCP/IP stack is triggered by the packet, causing the kernel to execute attacker-controlled code. No authentication or user interaction is required.
Prerequisites
  • Network connectivity to the target Windows system
  • The target system must be connected to a network where packets can reach the TCP/IP stack
remotely exploitableno authentication requiredlow complexity
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/4
Do now
0/1
WORKAROUNDRestrict network access to Windows systems from untrusted networks using firewall rules
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXApply the October 2026 Microsoft security update to all affected Windows systems
HOTFIXPrioritize patching Windows systems used for engineering workstations, HMI consoles, and historian servers first
Long-term hardening
0/1
HARDENINGImplement network segmentation to isolate Windows systems used for OT operations from corporate networks and the internet
View full vendor advisory
API: /api/v1/advisories/f295df1a-a81e-4ec0-bda0-0304066e17ac

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Windows TCP/IP Remote Code Execution Vulnerability | CVSS 8.1 - OTPulse