CVE-2026-54113: Windows 10 1607 DoS Vulnerability

CVE-2026-54113 Overview

CVE-2026-54113 is a network-based denial of service vulnerability in the Microsoft Windows Kernel. The flaw stems from allocation of resources without limits or throttling, classified under [CWE-770]. An unauthenticated remote attacker can send crafted network traffic that forces the kernel to consume system resources without bounds, leading to service disruption on the target host.

The vulnerability affects a broad range of client and server Windows versions, from Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Windows Server 2025. No user interaction or prior authentication is required to trigger the condition.

Critical Impact
An unauthenticated attacker can remotely exhaust Windows Kernel resources over the network, causing availability loss across affected Windows client and server systems.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-54113 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-54113

Vulnerability Analysis

CVE-2026-54113 is an uncontrolled resource consumption flaw within the Windows Kernel. The kernel component fails to enforce upper bounds on resources it allocates in response to inbound network requests. Repeated or malformed requests cause the kernel to reserve memory, handles, or other objects beyond sustainable limits.

Because the flaw resides in the kernel, resource exhaustion affects the entire operating system rather than a single user process. Successful exploitation results in unresponsive systems, dropped network connectivity, or a full system halt requiring a reboot. Confidentiality and integrity are not impacted, but availability is fully compromised.

The issue is tracked under EPSS with a probability of 1.126% at the 63rd percentile, reflecting moderate near-term exploitation likelihood relative to other published CVEs.

Root Cause

The root cause is missing throttling or quota enforcement on kernel-side allocations triggered by network input, matching the [CWE-770] pattern of allocation of resources without limits. The kernel processes inbound requests and reserves resources without validating that cumulative consumption remains within safe thresholds.

Attack Vector

Exploitation occurs over the network with low attack complexity and no privileges required. An attacker with network reachability to an exposed Windows service that routes into the vulnerable kernel path can transmit repeated or specifically shaped requests. Sustained transmission drains kernel resources until the target becomes unresponsive.

No public proof-of-concept exploit or CISA KEV listing is currently associated with CVE-2026-54113. Refer to the Microsoft CVE-2026-54113 Advisory for vendor technical details.

Detection Methods for CVE-2026-54113

Indicators of Compromise

Sudden and sustained spikes in kernel non-paged pool usage or handle counts on Windows hosts.
Repeated inbound network sessions from a single source that precede system unresponsiveness or reboot events.
Event Log entries reflecting Resource-Exhaustion-Detector warnings or unexpected system hangs.

Detection Strategies

Baseline kernel memory pool usage per host and alert on sharp deviations correlated with network activity.
Correlate network flow telemetry with host performance counters to identify low-volume, high-impact traffic patterns targeting Windows services.
Hunt for unauthenticated inbound connections to Windows services from untrusted network segments preceding availability incidents.

Monitoring Recommendations

Ingest Windows performance counters (Memory\Pool Nonpaged Bytes, Process\Handle Count) and Event Log channels into a centralized analytics platform.
Monitor edge and internal firewall telemetry for anomalous connection rates to Windows hosts.
Track patch compliance status for the affected Windows 10, Windows 11, and Windows Server builds listed in the Microsoft advisory.

How to Mitigate CVE-2026-54113

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-54113 Advisory to all affected Windows client and server systems.
Prioritize patching of internet-exposed Windows Servers and any hosts running network-facing services accessible from untrusted networks.
Inventory affected Windows builds using existing asset management tooling and confirm patch deployment status.

Patch Information

Microsoft has released security updates addressing CVE-2026-54113. Consult the vendor advisory for the specific KB article, cumulative update identifier, and build numbers that correspond to each affected Windows version. Apply the updates through Windows Update, WSUS, Microsoft Update Catalog, or your endpoint management platform.

Workarounds

Restrict network access to Windows hosts using host-based and perimeter firewalls, permitting only trusted source ranges to reach exposed services.
Segment critical Windows Server workloads onto isolated network segments until patches are validated and deployed.
Enforce rate limiting and connection quotas on network devices in front of Windows systems that cannot be immediately patched.

bash

# Example: restrict inbound access to a Windows host using Windows Firewall (PowerShell)
New-NetFirewallRule -DisplayName "Restrict-Inbound-Trusted-Only" `
  -Direction Inbound `
  -Action Block `
  -RemoteAddress Any `
  -Profile Any

New-NetFirewallRule -DisplayName "Allow-Trusted-Mgmt-Subnet" `
  -Direction Inbound `
  -Action Allow `
  -RemoteAddress 10.10.0.0/24 `
  -Profile Domain