CVE-2026-56188 is a race condition in a core Windows Server network driver that an unauthenticated attacker can exploit remotely. It affects every supported Windows Server. Patch it.
Some vulnerabilities need a user to click something or an attacker to have a foothold. CVE-2026-56188 needs neither — it's a race condition in a Windows Server network driver that an unauthenticated attacker can exploit remotely, with nothing but network traffic. Microsoft rates it a 9.8, it affects every supported Windows Server (2012 through 2025) plus Windows 10 and 11, and code execution in a kernel-level network driver means deep, privileged control of the machine. There's one nuance that slightly softens it — the attack complexity is high — but a network-driver RCE across the entire Windows Server fleet is a patch you don't defer.
0.0/ 10
CVSS severity: Critical (Microsoft)
Unauthenticated race-condition RCE in a network driver — Microsoft scores it 9.8; NIST 8.1 (higher attack complexity).
Why a network-driver RCE is serious
Network drivers run in the kernel, at the highest privilege level, and they process untrusted data by design — every packet that arrives. A remote code execution flaw there means an attacker who can send traffic to the machine can potentially run code with kernel privileges, which is about as deep as compromise gets. Combine that with 'unauthenticated' and 'affects every supported Windows Server' and you have a flaw that belongs at the top of the patch list, alongside the month's other network-reachable criticals. The one mitigating factor is the high attack complexity — NIST's 8.1 reflects that the race condition may be harder to win reliably — but 'harder' is not 'safe,' especially for a bug this widespread.
A network driver processes every packet at kernel level — a remote code execution flaw there is deep, privileged compromise. · Unsplash
What to do
Apply the July 2026 security update across Windows Server 2012–2025 and Windows 10/11 — every supported version is affected.
Prioritise internet-facing servers and critical infrastructure, where network-reachable RCE has the highest impact.
Restrict network access to servers where possible — segmentation limits who can reach the vulnerable driver.
Bundle this with the July batch's other criticals — the [DHCP](/windows-dhcp-server-rce-cve-2026-50518-patch-now) and [RDP](/windows-rdp-rce-cve-2026-56190-patch-now) RCEs — in one push.
Quick answers
How serious is CVE-2026-56188?
Very — it's an unauthenticated remote code execution flaw in a kernel-level Windows Server network driver, which Microsoft rates 9.8. Code execution there means privileged control of the machine, reachable over the network with no login or user interaction. The one caveat is high attack complexity (NIST scores it 8.1), meaning the race condition may be harder to exploit reliably. But given it affects every supported Windows Server, treat it as a top-priority patch, especially for internet-facing systems.
Why do Microsoft and NIST score it differently?
Microsoft rates it 9.8, NIST 8.1 — the gap is attack complexity. NIST judges the race condition harder to win reliably (a higher-complexity exploit), which lowers its score, while Microsoft's assessment treats it as more readily exploitable. For prioritisation, assume the higher end: a widespread, unauthenticated, network-reachable RCE in a kernel driver is dangerous regardless of the exact number. Patch it as a critical, not a moderate.
Which systems need this patch?
Every supported Windows Server — 2012, 2012 R2, 2016, 2019, 2022, and 2025 — plus Windows 10 and 11 across x64, 32-bit, and ARM64. That's essentially the entire Windows fleet. Prioritise internet-facing and critical servers, since a network-reachable RCE is most dangerous where the machine is exposed. Apply the July 2026 security update everywhere; there's no configuration that makes an unpatched, network-connected system safe from this.
An unauthenticated RCE in a network driver across every Windows Server is a patch-now bug, high attack complexity notwithstanding. Apply the July update and prioritise exposed servers. Sources: NVD and Rapid7. It's part of the month's Windows critical cluster with DHCP and RDP.
