CVE-2026-57089 is a high severity (CVSS 7.5) use after free in the Windows SMB Server network transport driver, srvnet.sys. The record says an unauthorized attacker can execute code over a network. Microsoft lists the fix for each edition in its Security Update Guide, so install it.
What's affected
Microsoft lists many Windows editions for this record, from Windows 10 1607 through Windows 11 26h1, and Windows Server 2012 among others. The record lists the affected Windows editions but no build numbers, and its only reference is the Microsoft Security Update Guide entry, which needs JavaScript to display. I could not read the fix details for this post.
The CVSS vector is AV:N/AC:H/PR:N/UI:R, with high impact on confidentiality, integrity and availability. High complexity and a required user action lower the score, but the effect is code execution on the server side of SMB.
How to check if you're exposed
Check which security update your machines have.
winver
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
- Open the Microsoft Security Update Guide entry and find the update for your Windows edition and build.
- Use your patch management tool or Windows Update reports to see which devices are missing it.
- Prioritize servers and internet facing systems.
What to do now
- Open the Microsoft Security Update Guide entry for CVE-2026-57089 and note the update for each Windows edition you run.
- Deploy the update to servers that share files first, then to workstations.
- Block SMB (TCP port 445) at the network edge, and do not expose it to the internet.
- Restrict SMB between internal segments to what is needed.
- Reboot when the update asks for it, then confirm the installed update on a sample of machines.
Why it matters
The weakness is CWE-416, use after free. Code keeps using a block of memory after it has been released, which lets an attacker who controls what refills that block change what the code does. In a kernel driver, that can mean running code with the highest privileges.
SMB is a service many networks run everywhere, so reducing where it is reachable cuts the risk from this and future flaws. The record is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Is port 445 exposure the main risk?
SMB reachable from untrusted networks widens the risk. The record's vector shows a network attack, so patch and also restrict where SMB can be reached.
Sources
Last reviewed: 19 October 2026.
