CVE-2026-45657Patch(microsoft / windows_11_23h2)

HIGHCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 12 mentions and remains active

Immediate actions

Patch microsoft windows_11_23h2 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network.

microsoft CVEs Back to dashboard

6.3/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45657

Weakness type (CWE)

CWE-122CWE-416

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1

Threat summary

Active exploitation appears in 3 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
32 mentions across 13 observed days

What's happening

Active exploitation reported across 3 signals
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 16 signals
Technical details provided in 29 signals
Disclosure: 12 classified signals
General: 6 classified signals
Peaked 11d ago at 12 mentions (2026-06-10); latest day: 1
32 total mentions across 13 days

Affected systems

Vendors

microsoft

Products

windows_11_23h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2022windows_server_2025

Deep dive

Activity timeline32 mentions / 13d

Signal classification4 categories

Patch

1340.6%

Disclosure

1237.5%

General

618.8%

Active Exploitation

13.1%

Referenced assets12 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-09	4	Disclosure2General1Patch1
2026-06-10	12	Active Exploitation1Disclosure3Patch8
2026-06-11	1	Patch1
2026-06-12	1	Disclosure1
2026-06-15	2	Disclosure1General1
2026-06-16	3	Disclosure1General1Patch1
2026-06-18	1	Disclosure1
2026-06-24	1	Patch1
2026-07-02	2	Disclosure2
2026-07-06	1	General1
2026-07-16	2	General2
2026-08-18	1	Patch1
2026-09-14	1	Disclosure1

Full discourse20 posts

TrendAI Zero Day Initiative@thezdi136d
General
It's the bug of the month for June 2026! CVE-2026-45657 - A CVSS 9.8 vulnerability in Kernel that allows remote, unauthenticated code execution at SYSTEM without user interaction. Yikes! https://t.co/Ohwjeeg8Pi
Post summary
The tweet announces CVE‑2026‑45657, a high‑severity kernel vulnerability enabling remote code execution without user interaction, but provides no PoC, exploit code, patches, or evidence of active exploitation.
21951325033.7K
88.8K followersView on X
Teegra 🧝‍♀️𝕏@Teeegra136d
Patch
ویندوز را آپدیت کن تا به فنا نرفتی مایکروسافت رکورد تاریخی انتشار وصله‌های امنیتی را شکست و با عرضه ۲۰۶ بروزرسانی امنیتی، از جمله ۳۹ آسیب‌پذیری با درجه «بحرانی» و ۱۶۷ مورد «مهم»، بزرگ‌ترین بسته ماهانه خود را منتشر کرد. در صدر این فهرست، آسیب‌پذیری CVE-2026-45657 با امتیاز CVSS 9.8 قرار دارد؛ یک نقص «استفاده پس از آزادسازی» (use-after-free) در هسته ویندوز که بدون نیاز به احراز هویت یا تعامل کاربر، امکان اجرای کد از راه دور با سطح دسترسی سیستمی را فراهم می‌کند! همچنین دو آسیب‌پذیری بحرانی دیگر با همین امتیاز، یکی در سرویس HTTP.sys ویندوز و دیگری در کلاینت DHCP ویندوز، شناسایی شده‌اند که هر دو بدون نیاز به اعتبارنامه قابل بهره‌برداری هستند. این بسته همچنین شامل وصله‌هایی برای سه آسیب‌پذیری «روز صفر» (zero-day) است که پیش از انتشار به‌صورت عمومی افشا شده بودند، از جمله دو نقص دور زدن رمزگذاری BitLocker به نام‌های YellowKey و bitskrieg، و یک آسیب‌پذیری ارتقاء سطح دسترسی در چارچوب CTFMON ویندوز. کارشناسان امنیتی افزایش چشمگیر تعداد وصله‌ها را به کارگیری هوش مصنوعی (AI) در کشف آسیب‌پذیری‌ها نسبت می‌دهند.
Post summary
Microsoft’s monthly patch release includes a 39‑critical‑vulnerability bundle, notably CVE‑2026‑45657, a use‑after‑free in the Windows kernel that allows remote code execution without authentication; the advisory lists technical details but no PoC or active exploitation evidence.
25059133.8K
19.1K followersView on X
𝕡𝕨𝕟𝕚𝕖@0xpwnie66d
Patch
MDASH is Microsoft's internal AI scanning system that finds vulnerabilities in Windows, the kernel, Hyper-V, Azure. It found CVE-2026-45657, a network-reachable kernel RCE with no authentication needed. Microsoft patched it without mentioning that technical details had already surfaced publicly. https://threat-modeling.com/microsoft-june-2026-patch-tuesday-critical-cves/
Post summary
Microsoft patched CVE-2026-45657, a network-reachable kernel RCE that requires no authentication, but no PoC, exploit code, or active exploitation details were provided.
06036112.3K
6.5K followersView on X
Horizon Secured@horizon_secured137d
Disclosure
🚨 𝗛𝗼𝗿𝗶𝘇𝗼𝗻 𝗔𝗹𝗲𝗿𝘁 – 𝗝𝘂𝗻𝗲 𝟮𝟬𝟮𝟲 𝗣𝗮𝘁𝗰𝗵 𝗧𝘂𝗲𝘀𝗱𝗮𝘆 After just one month without zero-days, we’re back to 𝟯 𝗻𝗲𝘄 𝘇𝗲𝗿𝗼-𝗱𝗮𝘆𝘀 and multiple nasty 9+ vulnerabilities. 𝗭𝗲𝗿𝗼-𝗗𝗮𝘆𝘀 🔸 CVE-2026-50507 – BitLocker Security Feature Bypass (YellowKey?) 🔸 CVE-2026-49160 – HTTP.sys Denial of Service 🔸 CVE-2026-45586 – CTFMON Elevation of Privilege 𝟵.𝟬+ 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 🔹 CVE-2026-45602 – Windows DHCP Server Tampering (9.1) 🔹 CVE-2026-42904 – Windows TCP/IP Elevation of Privilege (9.6) 🔹 CVE-2026-44815 – Windows DHCP Client Remote Code Execution (9.8) 🔹 CVE-2026-45657 – Windows Kernel Remote Code Execution (9.8) 🔹 CVE-2026-47291 – HTTP.sys Remote Code Execution (9.8) Full breakdown in this month’s Horizon Alert. #PatchTuesday #CyberSecurity #ZeroDay #Vulnerability #Microsoft
Post summary
The alert announces a batch of newly discovered zero‑day and high‑score Windows vulnerabilities, providing CVE IDs, affected components, and CVSS ratings but not any PoC, exploit code, or confirmation of active exploitation.
2201761.9K
2.6K followersView on X
VulnTracker@vuln_tracker136d
Disclosure
ZDI's bug of the month. Two of them. Both CVSS 9.8. 🔴 CVE-2026-45657 - Windows Kernel TCP/IP RCE. Remote. Unauthenticated. SYSTEM. Wormable. 🔴 CVE-2026-47291 - HTTP.sys RCE. Same deal. Microsoft rates this "Exploitation More Likely." Every researcher and bug shop on the planet is reversing these right now. Are you patched before they finish? 📡 http://VulnTracker.io
Post summary
ZDI announces two high‑severity Windows kernel and HTTP.sys Remote Code Execution vulnerabilities (CVE‑2026‑45657 and CVE‑2026‑47291), highlighting unauthenticated, wormable exploitation potential but providing no PoC, patch, or evidence of active exploitation.
00054817
681 followersView on X
Autumn Good@autumn_good_35136d
Patch
今月気になるのは、CopilotのRCEや情報漏えい（MSで対処済み）、WindowsカーネルのRCE（CVE-2026-45657）、悪用されそうなHTTP.sysのRCE（CVE-2026-47291）の影響を受ける設定が世の中にどれだけ存在しているのかですね。 The June 2026 Security Update Review https://www.zerodayinitiative.com/blog/2026/6/9/the-june-2026-security-update-review
Post summary
The post discusses newly disclosed CVEs, notes that Microsoft has patched them, and highlights the need to assess how many configurations are affected.
210321.3K
7.0K followersView on X
RubberDuck@RubberDuckCz100d
General
@JustWantToQ1 You are right that CVE marketing often hypes up local logic flaws as global threats. But dismissing a real, low-complexity, pre-auth network bug like CVE-2026-45657 just because modern architecture stops it from turning into a 2003-style box-dropper misses the point.
Post summary
The tweet argues against dismissing CVE‑2026‑45657 as hype, characterizing it as a real low‑complexity pre‑auth network flaw.
1001052
313 followersView on X
RubberDuck@RubberDuckCz100d
General
@JustWantToQ1 Take CVE-2026-45657 as a prime example. It’s a pre-auth Windows Kernel Use-After-Free with a CVSS of 9.8. This score literally means low attack complexity and zero user interaction. It is a textbook, pure system-level RCE, not a localized arbitrary code execution trick.
Post summary
The tweet describes the technical aspects of CVE‑2026‑45657 but provides no PoC, exploit code, patch information, or evidence of active exploitation.
10010109
313 followersView on X
CyberAlertsHQ@CyberAlertsHQ135d
Patch
🚨 UPDATE — June Patch Tuesday: Two CVSS 9.8 wormable flaws, not one. CVE-2026-45657 (Windows Kernel, TCP/IP) AND CVE-2026-47291 (HTTP.sys) are both remote, unauthenticated, no user interaction required. Zero Day Initiative is blunt: "every researcher and bug shop on the planet is reversing these patches right now." The WannaCry comparison is already being made. That 2017 worm hit 200,000 systems in 150 countries — even though Microsoft had patched it two months earlier. The window between patch and weaponized exploit may be days. If you haven't applied KB5094126 (Win11) or KB5094127 (Win10) yet, stop what you're doing. 👇 https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-exchange-server-zero-day-exploited-in-attacks/
Post summary
The post announces two 9.8-rated, wormable vulnerabilities and urges immediate patching with KB5094126/KB5094127, emphasizing the risk window and lack of user interaction.
01010300
77 followersView on X
ホーリーデイ@holy519136d
Patch
【2026年6月 Patch Tuesday 要注意CVE】 🔴 CVE-2026-45657 CVSS9.8：Windowsカーネル未認証RCE（ワーム化可能） 🟠 CVE-2026-45586：入力メソッドCTFMONの権限昇格（公開済みゼロデイ） 🟡 CVE-2026-49160 CVSS7.5：HTTP/2 Bomb（DoS） 🟡 CVE-2026-50507 CVSS6.8：BitLocker物理突破史上最大！Microsoftが2026年6月Patch Tuesdayで200件超の脆弱性を修正。うちゼロデイ3件。特にCVE-2026-45657はCVSS 9.8、認証不要のWindows Kernel RCE——ワーム化可能な最凶クラス。今すぐパッチを　→ https://www.bleepingcomputer.com/news/microsoft/microsoft-june-2026-patch-tuesday-fixes-3-zero-day-200-flaws/ #セキュリティ #PatchTuesday #CVE
Post summary
Microsoft released a Patch Tuesday update in June 2026 fixing over 200 vulnerabilities, including three zero-days such as CVE-2026-45657—a high‑severity, unauthenticated Windows kernel RCE capable of worm‑like propagation.
00020289
997 followersView on X
Upwind Security MDR@UpwindMDR136d
Disclosure
🚨Critical - Windows Kernel TCP/IP Remote Code Execution (CVE-2026-45657) Microsoft's June 2026 Patch Tuesday fixes a use-after-free / heap overflow (CWE-416, CWE-122) in how the Windows Kernel processes TCP/IP data. A remote, unauthenticated attacker can send specially crafted network packets to a vulnerable system and execute code at SYSTEM level, with no privileges and no user interaction. That profile - network-reachable, pre-auth, kernel-level, no interaction - makes it wormable. Microsoft rates exploitation "Less Likely" and there is no known public PoC yet, but researchers are already reversing the patch. Affected: Windows 11 (23H2/24H2/25H2/26H1) and Windows Server 2022/2025, including Server Core. 👉Apply the June 2026 Windows cumulative security updates to all affected Windows 11 and Windows Server systems.
Post summary
Microsoft has publicly disclosed CVE-2026-45657, a remote kernel RCE in Windows TCP/IP, detailing its exploitation vector and urging users to install the June 2026 patch; no PoC or active attacks are reported.
01010300
207 followersView on X
PatchDayAlert@patchdayalert114d
Disclosure
Microsoft says CVE-2026-45657 is 'Exploitation Less Likely.' The CVSS is 9.8. It's wormable. Researchers have it. Here's why that hazard rating doesn't mean what you think it means. https://patchdayalert.com/blog/windows-kernel-cve-2026-45657-exploitation-less-likely/?utm_source=x&utm_medium=social&utm_campaign=blog-tease&utm_content=windows-kernel-cve-2026-45657-exploitation-less-likely
Post summary
The blog post highlights CVE‑2026‑45657’s high CVSS score and wormability, while noting Microsoft’s assessment that exploitation is less likely, but it does not report active exploitation, provide a PoC, or mention patches.
0001049
76 followersView on X
UWillC@uwillc128d
Disclosure
June 2026 = Microsoft's largest Patch Tuesday ever. Tenable: 198 CVEs (32 critical). ZDI: 208. Both records. Includes a wormable kernel TCP/IP RCE, CVE-2026-45657, CVSS 9.8. And Microsoft credited OpenAI's Codex with reporting one of the zero-days.
Post summary
The post highlights Microsoft’s largest Patch Tuesday, detailing 198 CVEs, including a wormable kernel TCP/IP RCE (CVE‑2026‑45657) with a CVSS score of 9.8, but does not provide exploit code, active exploitation reports, or specific patches.
1000084
498 followersView on X
كاسبر سكاي@KasperskyDev130d
Patch
⚠️ ثغرة حرجة قابلة للانتشار الذاتي في نواة ويندوز تتيح تنفيذ أوامر بصلاحيات النظام دون مصادقة عبر مكدس الشبكة المعرّف : CVE-2026-45657 درجة الخطورة : 9.8 (CVSS) - Critical الحل : Install June 2026 Patch Tuesday update #CVE #Microsoft #Windows #CVE202645657
Post summary
Microsoft issued a June 2026 Patch Tuesday update to fix CVE-2026-45657, a critical Windows kernel flaw that enables system‑level command execution via the network stack.
01000140
40.0K followersView on X
TheNu11Sector@Nu11Sector130d
Disclosure
3.🧵 The ones to patch first: 🚨 CVE-2026-45657 — Windows Kernel RCE | CVSS 9.8 No auth. No user interaction. Remote SYSTEM execution. 🚨 CVE-2026-47291 — HTTP.sys RCE | CVSS 9.8 Unauthenticated remote code execution via HTTP request.
Post summary
The tweet lists two new high‑severity CVEs, CVE‑2026‑45657 and CVE‑2026‑47291, and encourages users to prioritize patching them, but provides no PoC, exploit code, or evidence of active exploitation.
10000112
493 followersView on X
Cyber Netsec IO@NetSecIO134d
Patch
🚨 Microsoft's June 2026 Patch Tuesday is a record-breaker, fixing over 200 flaws, 33 critical RCEs, and 3 zero-days. A potentially wormable kernel bug (CVE-2026-45657) requires immediate patching. ⚠️ #PatchTuesday #CyberSecurity #ZeroDay 🌐 cyber[.]netsecops[.]io https://t.co/UJMkGgudJq
Post summary
Microsoft’s June 2026 Patch Tuesday addresses CVE‑2026‑45657, a potentially wormable kernel flaw, and urges immediate patching as part of the release.
00010119
59 followersView on X
CyberAlertsHQ@CyberAlertsHQ136d
Patch
🚨 NEW: Microsoft June Patch Tuesday just dropped — a record 200+ CVEs including 6 zero-days. The most urgent: CVE-2026-42897, an Exchange Server zero-day that's been actively exploited for weeks. A crafted email executes JavaScript in the victim's browser. A permanent patch is now available for the first time. Also critical today: a wormable Windows kernel flaw (CVE-2026-45657, CVSS 9.8) requiring zero credentials and zero user interaction, plus YellowKey — a BitLocker bypass via physical access to WinRE. Apply KB5094126 (Win11) or KB5094127 (Win10) immediately. Big patch day. 👇 https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-exchange-server-zero-day-exploited-in-attacks/
Post summary
Microsoft released a June Patch Tuesday with over 200 CVEs, including a widely exploited Exchange zero‑day and a wormable kernel flaw. Patches have been issued and immediate application is advised.
10000121
77 followersView on X
Divinmentis@Divinmentis136d
Patch
🔴 Microsoft June 2026 Patch Tuesday: record 208 CVEs — largest monthly release ever recorded Lead threat: CVE-2026-45657, CVSS 9.8 wormable Windows kernel RCE. No auth required, no user interaction. Exploits self-propagate network-wide. Researchers actively reversing now. Patch immediately. #CyberSecurity #PatchTuesday
Post summary
The tweet warns that CVE‑2026‑45657 is a severe Windows kernel RCE that can self‑propagate; it urges immediate patching but offers no PoC, exploit, or evidence of active attacks.
10000153
18 followersView on X
Erwin Mike Schuster ITAT@Erwin_Mike_S136d
Patch
🚨 Microsoft June 2026 Patch Tuesday just dropped — RECORD 206 CVEs (39 Critical). • CVE-2026-45657 (CVSS 9.8) • CVE-2026-47291 (CVSS 9.8) • CVE-2026-45586 (CVSS 9.8) Plus 3 zero-days (BitLocker bypass + HTTP/2 Bomb). #PatchTuesday #CyberSecurity #CISO https://t.co/vhm88v63VJ
Post summary
The tweet announces Microsoft’s June 2026 Patch Tuesday, highlighting a record 206 CVEs—including several zero‑days—with high CVSS scores and noting that patches are being released.
00010132
38 followersView on X
kawn@kawn2020136d
Disclosure
#windowsupdate #microsoft つづき・CVE-2026-44815　9.8　Windows DHCP クライアント・CVE-2026-45657　9.8　Windows カーネル・CVE-2026-47291　9.8　Windows HTTP.sys ・CVE-2026-47643　9.8　Azure Stack Edge ・CVE-2026-48567　10　 Azure HorizonDB
Post summary
The tweet enumerates several high‑severity CVEs affecting Windows and Azure components, providing identifiers and severity scores but no further technical or exploitation details.
10000184
85 followersView on X

CPE platform detail10 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

10 of 10 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_11_23h2	-	-	arm64
OS	microsoft	windows_11_23h2	-	-	x64
OS	microsoft	windows_11_24h2	-	-	arm64
OS	microsoft	windows_11_24h2	-	-	x64
OS	microsoft	windows_11_25h2	-	-	arm64
OS	microsoft	windows_11_25h2	-	-	x64
OS	microsoft	windows_11_26h1	-	-	arm64
OS	microsoft	windows_11_26h1	-	-	x64
OS	microsoft	windows_server_2022	-	-	-
OS	microsoft	windows_server_2025	-	-	x64

Explore more

Back to dashboard microsoft CVEs windows_11_23h2 vulnerabilities

What researchers are saying

CVE-2026-45657

TrendAI Zero Day Initiative[verified]@thezdiGeneral

The tweet announces CVE‑2026‑45657, a high‑severity kernel vulnerability enabling remote code execution without user interaction, but provides no PoC, exploit code, patches, or evidence of active exploitation.

Teegra 🧝‍♀️𝕏[verified]@TeeegraPatch

Microsoft’s monthly patch release includes a 39‑critical‑vulnerability bundle, notably CVE‑2026‑45657, a use‑after‑free in the Windows kernel that allows remote code execution without authentication; the advisory lists technical details but no PoC or active exploitation evidence.

𝕡𝕨𝕟𝕚𝕖[verified]@0xpwniePatch

Microsoft patched CVE-2026-45657, a network-reachable kernel RCE that requires no authentication, but no PoC, exploit code, or active exploitation details were provided.

Horizon Secured[verified]@horizon_securedDisclosure

The alert announces a batch of newly discovered zero‑day and high‑score Windows vulnerabilities, providing CVE IDs, affected components, and CVSS ratings but not any PoC, exploit code, or confirmation of active exploitation.

VulnTracker[verified]@vuln_trackerDisclosure

ZDI announces two high‑severity Windows kernel and HTTP.sys Remote Code Execution vulnerabilities (CVE‑2026‑45657 and CVE‑2026‑47291), highlighting unauthenticated, wormable exploitation potential but providing no PoC, patch, or evidence of active exploitation.

RubberDuck[verified]@RubberDuckCzGeneral

The tweet argues against dismissing CVE‑2026‑45657 as hype, characterizing it as a real low‑complexity pre‑auth network flaw.

RubberDuck[verified]@RubberDuckCzGeneral

The tweet describes the technical aspects of CVE‑2026‑45657 but provides no PoC, exploit code, patch information, or evidence of active exploitation.

CyberAlertsHQ[verified]@CyberAlertsHQPatch

The post announces two 9.8-rated, wormable vulnerabilities and urges immediate patching with KB5094126/KB5094127, emphasizing the risk window and lack of user interaction.