PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42904 Microsoft CVE debrief

CVE-2026-42904 is a critical vulnerability in Windows TCP/IP that allows an unauthorized attacker to elevate privileges over an adjacent network. The vulnerability has a CVSS score of 9.6 and is classified as CRITICAL.

Vendor
Microsoft
Product
Windows 10 Version 21H2
CVSS
CRITICAL 9.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-09
Original CVE updated
2026-06-11
Advisory published
2026-06-09
Advisory updated
2026-06-11

Who should care

Administrators and users of Windows 10, Windows 11, and Windows Server are advised to take immediate action to mitigate this vulnerability.

Technical summary

A heap-based buffer overflow vulnerability exists in Windows TCP/IP, which allows an unauthorized attacker to elevate privileges over an adjacent network. The vulnerability is caused by improper handling of TCP/IP packets, leading to a buffer overflow condition.

Defensive priority

High

Recommended defensive actions

  • Apply patches and updates from Microsoft as soon as possible.
  • Implement network segmentation and isolation to limit the attack surface.
  • Monitor network traffic for suspicious activity.

Evidence notes

The vulnerability is confirmed by Microsoft and has been analyzed by the National Vulnerability Database (NVD).

Official resources

CVE-2026-42904 was published on 2026-06-09T17:17:09.983Z and modified on 2026-06-11T16:15:55.030Z.