Privilege escalation affecting Windows SMB server
A vulnerability affecting the SMB component of Windows would allow a malicious actor with low-privileged local access to elevate privileges on the affected system.
Description
Technical context and vulnerability details
The Windows SMB server (srv.sys, srv2.sys, and srvnet.sys drivers) is a central component of Windows systems, used for file and printer sharing as well as network authentication via Kerberos. This component is affected by a vulnerability labeled CVE-2026-26128, resulting from incorrect authentication. Its exploitation would allow a malicious actor with low-privilege local access to the system to manipulate authentication requests made to the SMB server component in order to bypass privilege checks and gain elevated access to the system. The attack complexity is considered low and no user interaction is required, making the vulnerability easily exploitable once local access has been gained (via phishing or other initial access techniques). It is classified high with a severity score of 7.8 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Elevation of local privileges;
- Bypassing privilege checks from a low-privileged local account;
- Possible rebound to lateral movement or broader system compromise once elevated privileges are obtained;
Affected systems
Products, components and targeted versions
- All supported editions integrating the SMB server component (srv.sys, srv2.sys, srvnet.sys), i.e. Windows 10 (1607 to 22H2), Windows 11 (23H2 to 26H1), Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Immediately apply the March 2026 Microsoft security update correcting the vulnerability on all affected systems;
- Apply the principle of least privilege on local accounts and restrict local access to critical systems hosting the SMB service;
- While waiting for the patch to be deployed, monitor the Windows event logs (IDs 4672, 4673, 4674) to detect any authentication or privilege escalation anomaly related to the SMB server;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.