CVE-2026-78446 is a high severity (CVSS 7.5) remote code execution flaw in Windows Distributed File System (DFS). The fix is the September 2026 Windows security update. Microsoft has not marked it as exploited at release, and the CISA KEV flag is false. Check the MSRC entry for your exact build.
What's affected
Windows Distributed File System (DFS). The record lists the affected product families, and Microsoft's September 2026 update data lists the specific builds and the update (KB) number for each. Microsoft's data lists the customer action as required, so the fix is a normal security update.
The record lists Windows 10 versions 1607, 1809, 21H2 and 22H2 and Windows 11 versions 23H2, 24H2, 25H2 and 26H1.
Microsoft's data marks the issue as not publicly disclosed and not exploited at release, with an exploitability assessment of Exploitation Unlikely. The record's KEV flag is false. An assessment of this kind can change, so recheck the entry if the issue matters to you.
How to check if you're exposed
Check which update level the machine is on.
winver
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Microsoft's data lists KB5122876 among the updates for several Windows versions in this release, but the update number differs by Windows version, so confirm yours in the MSRC entry. To check for one KB, run Get-HotFix with the id parameter. Your endpoint management tool can report the same across the fleet.
What to do now
- Open the Microsoft update guide entry and find the update that applies to your exact build.
- Deploy the September 2026 security update through your normal patch process, test group first, then broad rollout.
- Confirm the update installed on a sample of machines, then report coverage across the fleet.
- Give file servers and domain controllers that host DFS namespaces priority in the rollout, and keep DFS ports off untrusted networks.
Why it matters
The weakness is CWE-416, use after free. A use-after-free means a piece of memory was released and then used again. If an attacker can control what sits in that memory afterward, they may redirect the program. Microsoft says an authorized attacker could run code over the network, and the vector rates confidentiality, integrity and availability all as high.
The published description is a single sentence, and Microsoft does not add technical detail for most of these issues. That is typical, and it is the reason to judge risk by exposure: who can reach the vulnerable component, and how fast you can patch it. The record requires low privileges and high complexity, so the attacker needs an account on the network and has to get the timing right.
Quick check
Why is the exploitability assessment low if the impact is high?
Microsoft rates the likelihood separately from the impact. High complexity and a need for credentials lower the likelihood.
Which machines matter most?
Servers that host DFS namespaces or are reachable by many users.
Sources
Last reviewed: 18 October 2026.
