CVE-2026-72926: Windows ICS Use After Free Vulnerability

CVE-2026-72926 Overview

CVE-2026-72926 is a use-after-free vulnerability [CWE-416] in the Windows Internet Connection Sharing (ICS) service. An authenticated local attacker can trigger the flaw to elevate privileges on an affected Windows host. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) update guide.

Successful exploitation grants an attacker elevated privileges with high impact to confidentiality, integrity, and availability on the compromised system. The attack requires local access and low privileges but has high attack complexity. No public exploit code is available and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A local, authenticated attacker who wins a race condition against the ICS service can execute code in an elevated context, enabling full system compromise.

Affected Products

Microsoft Windows (Internet Connection Sharing service component)
Refer to the Microsoft Security Update Guide for the complete list of affected builds
No specific product CPE entries were published in NVD at the time of writing

Discovery Timeline

2026-09-08 - CVE-2026-72926 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72926

Vulnerability Analysis

The vulnerability is a use-after-free condition in the Windows Internet Connection Sharing (ICS) service. ICS is a Windows component that shares an internet connection with other devices on a local network by acting as a NAT and DHCP provider. The service runs with elevated privileges and processes local IPC requests from unprivileged callers.

A use-after-free occurs when code references memory after it has been released back to the allocator. If an attacker can influence allocation state between the free and the subsequent dereference, the reused memory can hold attacker-controlled data. In a privileged service such as ICS, this can be leveraged to redirect control flow and execute code with SYSTEM privileges.

The high attack complexity reflects the race-condition characteristics typical of this bug class. An attacker must reliably trigger the free, place controlled data into the reclaimed allocation, and force the vulnerable code path to dereference the stale pointer.

Root Cause

The root cause is improper object lifetime management inside the ICS service [CWE-416]. A code path releases a heap object while another reference to the same object remains in use, allowing subsequent operations to act on freed memory. Microsoft has not published detailed internals for the affected function.

Attack Vector

The attack vector is local. An authorized user on the target system triggers the vulnerable ICS code path through its local interface, then races to reclaim the freed allocation with controlled contents before the dangling reference is used. No user interaction is required beyond the attacker's own actions.

No public proof-of-concept exploit is available. Technical specifics are limited to the vendor advisory. See the Microsoft Security Update Guide for authoritative details.

Detection Methods for CVE-2026-72926

Indicators of Compromise

Unexpected crashes or restarts of the SharedAccess service, which hosts Internet Connection Sharing
Windows Error Reporting (WER) records referencing ipnathlp.dll or the svchost.exe instance hosting ICS
New processes spawned as NT AUTHORITY\SYSTEM from a parent chain that includes the ICS service host
Unexpected enablement of the ICS service on hosts where it is not operationally required

Detection Strategies

Alert on non-administrative users interacting with the ICS service or toggling its state
Correlate service crashes of SharedAccess with subsequent privileged process creation on the same host
Baseline the expected population of hosts running ICS and flag deviations
Hunt for suspicious child processes of the svchost.exe group hosting ICS, particularly command shells and script interpreters

Monitoring Recommendations

Forward Windows Security, System, and Application event logs to a central store for correlation
Enable Sysmon Event ID 1 (process creation) and Event ID 10 (process access) for service-host processes
Monitor for Event ID 7031/7034 indicating unexpected service termination of SharedAccess
Track patch compliance for Windows systems against the fixed builds listed in the MSRC advisory

How to Mitigate CVE-2026-72926

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows systems
Inventory hosts where the Internet Connection Sharing service is enabled and prioritize them for patching
Restrict interactive and remote logon rights on affected systems to trusted administrators until patching completes
Verify endpoint protection is active and reporting on all Windows hosts in scope

Patch Information

Microsoft has released updates addressing CVE-2026-72926 through the standard Windows Update channel. Consult the MSRC advisory for the specific KB articles and build numbers that remediate the vulnerability on each supported Windows release. Deploy updates through Windows Update, WSUS, Microsoft Configuration Manager, or Intune according to your patch management process.

Workarounds

Disable the Internet Connection Sharing (SharedAccess) service on systems that do not require it
Enforce least-privilege access to reduce the population of users able to trigger the local attack path
Apply Windows Defender Application Control or AppLocker policies to limit execution of unauthorized binaries by standard users

bash

# Configuration example: disable ICS where it is not required
sc.exe config SharedAccess start= disabled
sc.exe stop SharedAccess