Wormable Windows kernel flaw CVE-2026-45657 exposes Windows 11 and Server systems
A newly disclosed flaw in the Windows kernel, CVE-2026-45657, could let attackers take over Windows 11 and Windows Server machines over a network with no password and no user interaction. Microsoft $MSFT rates it critical with a severity score of 9.8, and researchers warn it is w
A critical Windows kernel vulnerability disclosed in June's Patch Tuesday, CVE-2026-45657, sits in the code that handles network traffic and allows remote, unauthenticated code execution with no user interaction. It carries a CVSS severity score of 9.8 and is considered wormable, so one compromised machine could automatically spread to others on the same network. Affected systems include Windows 11 versions 23H2 through 26H1 and Windows Server 2022 and 2025, including Server Core. Microsoft $MSFT currently rates active exploitation as less likely and reports no known public attacks, but researchers are already studying the patch. The most effective protection is installing the June update without delay.