the Windows Print Spooler is a security hole again. if your servers don't print, just turn it off

CVE-2026-58608 is a fresh remote code execution flaw in the same Windows service that gave us PrintNightmare. It's on by default on virtually every…

Aliteq
Priya Nair · Software & Systems Editor

What you need to know

The flaw: a race condition and use-after-free in Windows Print Spooler (CWE-362, CWE-416) that lets a low-privileged attacker execute code over the network.

What you need to know

No user interaction required, low attack complexity — it just needs a foothold with basic authenticated access.

What you need to know

Affected: Windows 10, Windows 11, and Windows Server 2012 through 2025 — an enormous footprint, because Print Spooler is enabled by default.

What you need to know

Scores vary: Microsoft rates it 8.8, NIST 7.5 — the difference is attack complexity, but treat it as a high-priority RCE either way.

What you need to know

Fix: the July 2026 update. Better still: disable the Print Spooler service anywhere it isn't genuinely needed.

The one-liner worth running

On any server that doesn't print, disabling the Spooler takes seconds: Stop-Service -Name Spooler -Force then Set-Service -Name Spooler -StartupType Disabled. Do it via Group Policy across your…

Aliteq

Read the full story

the Windows Print Spooler is a security hole again. if your servers don't print, just turn it off

 Read the full story on Aliteq