CVE-2026-72936

CVE-2026-72936 is a use-after-free memory-safety flaw (CWE-416) in the Windows SMB Client, the built-in component Windows uses to connect to SMB file shares and servers. An unauthenticated, remote attacker can trigger the flaw over the network; because this is a client-side bug, the target's SMB Client must process attacker-influenced input, most plausibly when the Windows host connects to a malicious or attacker-controlled SMB server (for example via a UNC path, link, or name resolution), and the high attack-complexity score (AC:H) indicates specific conditions or timing are required. Successful exploitation yields arbitrary code execution on the affected host, with the CVSS vector rating high impact on confidentiality, integrity, and availability. Any Windows system that uses the SMB Client is affected — in practice essentially all supported Windows client and server installations. As of now there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at 0.6%, so no confirmed in-the-wild exploitation is known.

What to do: Apply Microsoft's security update for CVE-2026-72936 through Windows Update as soon as it is released, and verify your builds against the affected-version list in Microsoft's advisory. Until patched, restrict outbound SMB (TCP 445) to untrusted networks and hosts, and treat UNC paths, shortcuts, or references pointing to unknown SMB servers with caution. Use firewall or host logs to identify systems initiating SMB connections to external or untrusted hosts, as those are the most plausible targets for this client-side bug.