CVE-2026-57089 Overview
CVE-2026-57089 is a use-after-free vulnerability in the Windows Server Message Block (SMB) Server Network Transport Driver (srvnet.sys). The flaw allows an unauthenticated remote attacker to execute arbitrary code over the network by sending crafted SMB traffic to an affected system. Because srvnet.sys runs in kernel mode, successful exploitation grants SYSTEM-level code execution on the target. The vulnerability affects a broad range of Windows client and server releases, including Windows 10, Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. Microsoft published the advisory on July 14, 2026, and tracks the flaw under [CWE-416: Use After Free].
Critical Impact
Unauthenticated remote code execution in the SMB kernel driver enables wormable attacks against exposed Windows hosts across enterprise networks.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-07-14 - CVE-2026-57089 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-57089
Vulnerability Analysis
The vulnerability resides in srvnet.sys, the kernel-mode network transport driver that handles SMB session establishment and packet framing. A use-after-free condition occurs when the driver references a memory object after it has been released back to the pool. An attacker who controls the timing and content of successive SMB requests can reclaim the freed allocation with attacker-influenced data. Dereferencing the stale pointer then transfers execution flow or corrupts kernel state.
Because srvnet.sys processes traffic before authentication completes, no valid credentials are required. Exploitation over TCP port 445 makes the flaw a candidate for self-propagating worm payloads similar to prior SMB kernel vulnerabilities.
Root Cause
The root cause is improper object lifetime management within the SMB transport packet handling path [CWE-416]. Concurrent request processing releases a shared object while another code path retains and later uses a reference to it. Kernel pool grooming allows an attacker to place controlled data in the reclaimed slot before the dangling pointer is dereferenced.
Attack Vector
Exploitation requires network reachability to TCP port 445 on the target. The attacker sends a sequence of SMB negotiation or session-setup packets crafted to trigger the free-then-reuse condition. Successful exploitation results in kernel code execution with full SYSTEM privileges, enabling lateral movement, credential theft, and payload deployment across the domain.
No public proof-of-concept or in-the-wild exploitation has been confirmed at publication. See the Microsoft Security Update for CVE-2026-57089 for authoritative technical details.
Detection Methods for CVE-2026-57089
Indicators of Compromise
- Unexpected SMB traffic from untrusted networks or unusual internal sources to TCP port 445.
- Kernel bugchecks or srvnet.sys crashes recorded in the System event log or as memory dumps.
- Spawning of privileged processes by System or svchost.exe immediately following inbound SMB sessions.
Detection Strategies
- Monitor SMB traffic patterns for malformed negotiation or session-setup packets and abnormal request sequencing.
- Alert on kernel-mode exceptions originating from srvnet.sys or srv2.sys.
- Correlate inbound SMB connections with subsequent creation of new user accounts, service installations, or lateral movement over SMB or WMI.
Monitoring Recommendations
- Enable Windows SMB Server auditing and forward events to a centralized log store for retention and correlation.
- Deploy network-based IDS/IPS signatures for anomalous SMB traffic and pre-authentication protocol violations.
- Track patch state across all Windows hosts using vulnerability management tooling and flag systems missing the July 2026 security update.
How to Mitigate CVE-2026-57089
Immediate Actions Required
- Apply the Microsoft security update for CVE-2026-57089 to all affected Windows client and server versions.
- Block inbound TCP port 445 at the network perimeter and restrict east-west SMB traffic to explicitly required hosts.
- Inventory Internet-exposed SMB endpoints and take them offline until patched.
Patch Information
Microsoft released fixes as part of the July 2026 security updates. Refer to the Microsoft Security Update for CVE-2026-57089 advisory for build numbers and KB articles corresponding to each affected Windows release.
Workarounds
- Restrict SMB access using Windows Firewall rules limiting TCP port 445 to trusted management subnets.
- Disable SMBv1 where still enabled and enforce SMB signing and encryption on SMBv2/SMBv3 sessions.
- Segment legacy servers that cannot be patched immediately into isolated VLANs with strict egress controls.
# Block inbound SMB at the host firewall on Windows
New-NetFirewallRule -DisplayName "Block Inbound SMB 445" `
-Direction Inbound -Protocol TCP -LocalPort 445 -Action Block
# Verify SMB server configuration and require signing
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol, RequireSecuritySignature, EncryptData
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
