CVE-2026-72926

Windows Internet Connection Sharing (ICS), the component that lets a Windows host share its network connection with other devices, contains a use-after-free memory-safety flaw (CWE-416). An attacker who already has low-privileged authorized access on the machine can trigger the freed-memory condition in the ICS component; the high attack complexity (AC:H) indicates that reliable exploitation is technically difficult. A successful exploit results in elevation of privilege on the local system, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.0). Any Windows system that ships the ICS component is affected, with the greatest relevance to hosts where connection sharing or hotspot functionality is actually in use. There is no known exploitation, no public proof-of-concept, and EPSS assigns a low 0.3% probability of exploitation within 30 days.

What to do: Apply the Microsoft security update addressing CVE-2026-72926 through your normal Windows patching process; given the local-only attack vector, high complexity, and absence of known exploitation, standard monthly patch-cycle priority is reasonable. Inventory hosts where Internet Connection Sharing or the Mobile Hotspot feature is enabled, since those are the most relevant targets, and limit untrusted users' ability to run code locally on shared or multi-user Windows machines.